Email/SMS based MFA will count, but shouldn't.

(Or at least, a better option should be required to be available.)