I don't disagree with you - I don't think mandatory phone numbers are the answer. I would also point out that most email isn't encrypted, so any party along the line (including your mail provider) can see your secret tokens.