TOTP is pretty standard. Give the user backup codes and just use normal recovery methods. For most things that might be email. For a bank it's probably identity verification.
Email shouldn't be recovery for bank anywhere, you go to the bank for that. But TOTP is so user-hostile that I can see it causing too many recovery requests for the bank.
