Many service providers allow account recovery via sms, effectively making it the only factor needed. This is the big concern in my experience.