I think a while ago someone on HN suggested emoji as a joke as a more information-dense and internationalized alternative to numeric or alphanumeric verification codes. I don't know about security, but if this uses all 1,088 emoji from Unicode 9.0, then four emoji have about 40 bits of information.