I don't get it. Many people don't use a smartphone at all, and anyway smartphones are much less secure than ordinary mobile phones (w.r.t. criminals), so this s

I don't get it. Many people don't use a smartphone at all, and anyway smartphones are much less secure than ordinary mobile phones (w.r.t. criminals), so this seems even less reasonable than requiring the SMS-based method for sensitive operations like confirming money transfers when online banking. In fact, you should use a dumb phone for SMS-tokens if you want be on the safe side. (It would make more sense if the vast majority of Android phones wasn't insecure due to running an old OS with no updates, but that's not the case.)