This question already has an answer here:
I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone?
Is it secure? I think it is not a good practice to rely authentication only on such codes which come on mobile phone, because someone can just steal your mobile phone and that's it.
I think better alternative would be to combine the above mechanism with a username/password authentication. What is your opinion? What are the best practices in such direction?