content: My guess is they plan to follow something like tihis:  User attempts to log in using the IP address and browser fingerprint they always use. Send a one-time passcode via text to the phone so they don't have to bother with a likely insecure password. User attempts to log in using an unknown IP address and/or browser fingerprint. Stick with the pre-existing authentication method.  Yes, everyone should use long ass passwords that are unique for each account. Yes, everyone should use a password keeper to manage all these unique, long ass passwords. But almost everyone does neither. They will use the simplest password a site permits, and they will reuse that password as often as possible across the internet. Something a user has (smart phone) is way more secure than something they know (the likely weak password most users will choose). If you look at password databases people collect from breaches, you'll see most humans tend to choose the same passwords other humans use. Guessing against such a list is much less time consuming than trying to crack a password by brute force. And far, far easier than stealing all your intended victims' phones.