A mobile app running on a phone that does not receive security updates anymore (or the user not installing them) and a platform fully accessible to the NSA. I really prefer hardware tokens distributed by the bank. Even if the implementation might suck from cryptographic point of view, they are offline.
The second factor is typically a mobile app that prompts your biometric authentication, and this obviously allows geofencing ATM withdrawals.