Anything that requires the user to pull out the smartphone and launch an app to authenticate is bound to fail. There's no way around it.