3 ms·

This is essentially just two-factor using email... give me your phone and I can steal anything I need.

• aes 13y ago
  Assuming the phone isn't locked. A combination with email confirmation plus two-step verification like Google Authenticator could work as well.
  • parsnips 13y ago
    If the attacker has the phone, the second factor (typically sms) won't work very well.