It's fine if the user throws it out. The whole scheme is optional and the code is never activated until the user types it in first. The user can either: 1. Th

It's fine if the user throws it out. The whole scheme is optional and the code is never activated until the user types it in first. The user can either: 1. Throw it away. Then nothing happens; no 2FA is set up. 2. Type in the code in for a 10% discount. Again, no 2FA is set up so the user's security is never worst off than before. 3. Type in the code and setup 2FA. This is case the user is tech-savvy enough to properly setup 2FA and successfully authenticate with it (in order to claim the 20% discount) so they (hopefully) realize the importance and convenience of the pre-printed physical backup codes and will (hopefully) stash them away somewhere safe.