Many banks will offer you services like this if you ask for it, but they don't enable it by default because for most customers, the added hoops required to jump through will drive deter them. Not everyone is conscious about security. I recommend you ask your current bank if they can enable two-factor authentication for you, send you a token, etc. or call around to the technical support lines of various banks before you open an account. Customer service may not have knowledge of this, so technical support is probably your best bet. You can also look at the banks in this list and see if they have Canadian branches with a similar service.

However, it's important to keep in mind that two-factor authentication is probably better than simple multi-factor authentication, and it is technically more modern, but it won't protect you from modern threats like phishing, fraud, social engineering, etc. That's your responsibility. Bruce Schneier has an interesting article on this from a few years ago, in which he discusses modern security vulnerabilities, how they affect banking, and most importantly, how two-factor authentication doesn't protect you from them.

An attacker using a man-in-the-middle attack is happy to have the user deal with the SMS portion of the log-in, since he can't do it himself. And a Trojan attacker doesn't care, because he's relying on the user to log in anyway.

Two-factor authentication is not useless. It works for local login, and it works within some corporate networks. But it won't work for remote authentication over the Internet. I predict that banks and other financial institutions will spend millions outfitting their users with two-factor authentication tokens. Early adopters of this technology may very well experience a significant drop in fraud for a while as attackers move to easier targets, but in the end there will be a negligible drop in the amount of fraud and identity theft.

As he says, two-factor authentication isn't useless, but I'm not surprised that many banks don't offer it by default because a) it's costly to implement for them, b) it may deter users, and c) rest assured banks have performed a similar calculus to what Schneier describes and have found that it's only cost effective to offer it, if they offer it at all, to those users who request it.

Many banks will offer you services like this if you ask for it, but they don't enable it by default because for most customers, the added hoops required to jump through will drive deter them. Not everyone is conscious about security. I recommend you ask your current bank if they can enable two-factor authentication for you, send you a token, etc. or call around to the technical support lines of various banks before you open an account. Customer service may not have knowledge of this, so technical support is probably your best bet. You can also look at the banks in this list and see if they have Canadian branches with a similar service.

However, it's important to keep in mind that two-factor authentication is probably better than simple multi-factor authentication, and it is technically more modern, but it won't protect you from modern threats like phishing, fraud, social engineering, etc. That's your responsibility. Bruce Schneier has an interesting article on this from a few years ago, in which he discusses modern security vulnerabilities, how they affect banking, and most importantly, how two-factor authentication doesn't protect you from them.

An attacker using a man-in-the-middle attack is happy to have the user deal with the SMS portion of the log-in, since he can't do it himself. And a Trojan attacker doesn't care, because he's relying on the user to log in anyway.

Two-factor authentication is not useless. It works for local login, and it works within some corporate networks. But it won't work for remote authentication over the Internet. I predict that banks and other financial institutions will spend millions outfitting their users with two-factor authentication tokens. Early adopters of this technology may very well experience a significant drop in fraud for a while as attackers move to easier targets, but in the end there will be a negligible drop in the amount of fraud and identity theft.

As he says, two-factor authentication isn't useless, but I'm not surprised that many banks don't offer it by default because a) it's costly to implement for them, b) it may deter users, and c) rest assured banks have performed a similar calculus to what Schneier describes and have found that it's only cost effective to offer it, if they offer it at all, to those users who request it.