For a banking app it seems very very insecure. You can't require a pin (allows biometrics in place of pin with no override) for access to your account, your verification is done through text which can be spoofed. The implementation I'd suggest is requiring BOTH email and text for accounts with funding if they won't use a more secure method like authentication apps. They also should allow the use of a master pin on your account instead of defaulting whatever the device's pin is.