I love when sites do only that and then fail to deliver an email within 30 seconds.
a message to your phone "click to authenticate login
Should be both code and a link (enter 1234 or click <url>), because it’s not always the phone you’re loggin in on.