A cardholder unlocks a retailer's app with their face, browses, and checks out. They are then asked to authenticate again, this time by their bank, using a code sent by text message. The second authentication is weaker than the first and considerably…