Except that the phone itself is increasingly the target.  A compromised phone renders such &quot;second-factor&quot; idents moot.<p>I say &quot;second-factor&quot; in quotes because I don&#x27;t really consider the code-to-the-phone a second factor.  It&#x27;s just another password.  A proper second factor would be a token, a physical object or at least something that cannot be transmitted&#x2F;intercepted.<p>I&#x27;m running into this problem when doing PCI audits.  PCI demands two-factor for some things (internal, non-customers) but specifies the &#x27;something you know, something you have, and something you are&#x27; approach.  Since biometrics are out in most situations, that leaves passwords+tokens as a practical mandate under PCI.  Code-to-the-phone schemes don&#x27;t qualify.