My point is that it doesn't matter how many factors your authentication system has, it is still broken if someone spinning a yarn via telephone can get full access.