Very recently two large companies I deal with have started two-factor authentication: a major national brokerage, and also a major streaming media provider. I cannot know or say which company's technology they are using, but it is a striking policy change. However, they are trying to demand a person's cell phone number, not their land line number, which I find really intrusive and creepy.
It won't fly in Montana!
Dam surveillance society.