One text. Two ways to sign in.

A made-up bank texts you about your account. You'll follow the same link twice, first with a password and then with a passkey.

This is a simulation. The details are supplied for you, and nothing you tap leaves this phone.