It's 2016. They are a financial company. Why aren't they implementing TOTP codes? NIST officially deprecated SMS.