Revolut seems to work without physical presence.

And the website and app of my bank with offices is ... how should I put it ... a bit Kafkaesque.

The obvious thing banks should be doing is putting fucking restrictions on these accounts by default and let people ask for exceptions.

And of course if regulations don't encourage them to pick social-engineering-proof defaults then things won't improve.

they can wait.

how would the clueless victim check anyway?

Maybe? Let people form CAs, and if a CA gives out certs for malicious apps remove them. (Old apps continue to work, to publish new one get new cert.)

Yes, sad, but works.

People will learn about scams, but scammers are unfortunately a few steps ahead. (Lots of scammers, good techniques spread faster among them than among the general public.)