We are not, or rather have not yet, started mobile banking. I think the ROI argument is fairly moot considering its a free service and is more so about retention as you mentioned.
The part we have a hard time justifying similar to you is the typical "high cost" associated with an implentation of any and all methods as you described. Even more so we have a hard time justifying the risks of mobile banking (even in the most locked down capacity) before we even get into the cost discussion.
Ultimately the argument you should focus on is customer need? You should have access to your website analytics which would highlight how many customers are "accessing" your site via a mobile browser to begin with. This should begin to tell you, thanks to sophistication in mobile browsing, how many of your customers may be "mobile" banking without your help or protection.
Be careful when considering this data however because it may be a false metric in terms of mobile banking adoption. People may just legitimately be looking up hours, locations, etc... with no "mobile banking" intent, but it is still a good metric for addressing possible adoption.
From there our banks position is, if we can justify the risks, we can justify the product as "keeping up with the joneses." Any other argument you try to make becomes like quick sand and easily defeated in terms of actual cost benefit argument. We just haven't fully mitigated the risks, but we consider the cost just one of doing business in modern banking.
Hope that helps a bit.
Cheers!
_________________________
In life, there is a lot less that could get better and a lot more that could get worse.
MBA Fin/MBS HR
My views only!