An 8 digit code coupled with a gradual rate-limiting system offer probably a decent security trade-off for such a service. They probably use an all digit code s

An 8 digit code coupled with a gradual rate-limiting system offer probably a decent security trade-off for such a service. They probably use an all digit code so that people can authenticate easily over the phone.