It might not be perfect, but if they have phone numbers for their customers, why not set up an automated phone call system where a PIN is provided in the call? Email accounts can be compromised by hackers but I would think it would be much more difficult to co-opt customer's phone lines.