I have Fidelity so I decided to see what they have available. (No idea if the links work if you are not signed in to Fidelity)
https://www.fidelity.com/security/how-two-factor-authentication-works "With 2-factor authentication, an extra layer of security is added to your account to prevent someone from logging in, even if they have your password. This extra security measure requires you to verify your identity using a randomized 6-digit code. You can choose to have this security code sent to your mobile phone (or an alternate phone number) via text or voice call. Each security code is used only once. It is not a password that you need to create and remember."
This is not out-of-band so it is probably not SFOR. If the app responded back to a security server then it would be SFOR IP, but if they just get a code to type into a webpage, it is NOT out-of-band (and less secure).
Is Fidelity going through Microsoft? If they are, SFOR may be SOL. Everyone had to know the one time lump sum wasn’t as great as it seemed at the time. Microsoft had to benefit in some way.