Call them, say you are the bank and they have seen fraudulent transactions, and to restore the account they will send you a code which you have to tell them...

For the sms codes: it's also pretty easy to copy/clone a sim

There is also the option of a MITM attack with a portal that forwards the login to the real login page and then cuts your connection and the MITM has the open session.

The good thing with passkeys is, there is nothing a fraudster can get from a user. You can't forward your passkey via the phone, and MITM are much, much harder to pull off