I wonder whether asking for verification over the phone would lead to SIM swaps. Though faking someone's voice would be more difficult.
Eventually SIM swap attacks may get more common and a third channel (or two better channels than email + phone system) may be necessary.