Ah, thanks, you're right.

My bank's website specifically calls it "multi-factor authentication", and I never bothered to double-check the term.