It&#x27;s also expensive...the vast majority of users aren&#x27;t going to buy a U2F key and carry it around.  They just won&#x27;t.  2-way OOB authentication does protect against phishing when combined with other information, such as IP geolocation.  For example, the message could say &quot;if you are not in [city from which login is coming], do not reply to this message&quot;.