3 ms·

I've seen PCI auditors accept code-to-the-phone as proper two-factor auth many times. Not that you aren't right...