I'm not Kolev, so I don't know his reasoning. But I can guess. USSD is interactive. That lets you keep the one-time password's validity time short since you kn

I'm not Kolev, so I don't know his reasoning. But I can guess. USSD is interactive. That lets you keep the one-time password's validity time short since you know when the subscriber sees the one-time password. The other is that it's straightforward to require an interactive step, e.g. "press 7 to get a code". The interactive step makes an attack based on SMS forwarding harder. The short timeout makes an attack based on having limited access to a victim's phone harder. Not sure if the security improvements are worth the useability problems---people aren't familiar with USSD and, because it's not used as often, mobile terminal software for it is likely to be buggier.