two ideas are too much for some people

from here

don't get me wrong - out of band authentication is a cool idea, and it has some nice properties, but receiving a phone call is not the same as verifying a token.