SMS though provides a higher level of security. Some hacker anywhere on the planet could have accessed my email and passwords but they can't get a code sent to my phone unless they are nearby and have got hold of the phone. I'm not sure it being plain text and monitored matters much as all that's bring sent is a random number usually. I'll admit it could cost more and so may not be the thing for sites with lots of free users. If you can't get sms some sites will phone you with a recorded message.