Why can't they use an authenticator app such as Microsoft or Google. I use Lastpass and they positively encourage you to set up authenticators on multiple devices incase on gets nicked.
2FA is an excellent security device but 3, and others, need to implement it better.
