Card controls
Instead of always blocking cards, a transaction deemed suspicious can be flagged in the app with a push notification and request the user to confirm if it is genuine or not. Also finer-grained toggles like disallowing international in-store transactions or enabling online for 1 hour, etc. This stuff isn’t hard (other banks provide it) if you really care about security and customers.