A few quick things that come to mind:
What is the method of entry? If the user is inputting the password into the "chatbox", you run the risk of someone simply looking over the users shoulder and seeing the password.
Will you be using rate-limiting? SMS messages, while very cheap, are not free to send. You don't want to foot the bill when Joe decides to send ten-thousand password-reset messages to Carl. You'll also need to rate-limit entries, to avoid someone brute-forcing all possible combinations. Make sure you do this by both username and IP.
On that topic, you'll need to have a fairly long authentication code: most 2FA sites use 2FA as a backup method of authentication, not the "keys to the kingdom". Since you're relying to heavily on the server-generated code, you'll need to make sure it's long enough to make distributed brute-force infeasible.
You'll have to make sure to explain what the message is, in the body of the message. For example, "Your WidgetCo password reset code is: 123456" - this way, people can know that they're under attack, as opposed to just getting a bunch of random numbers over text (although since there's no other authentication, users can't do much even if they know they're under attack).
Finally, keep in mind that you're also at the mercy of the mobile carriers security - all this is for naught if I can just call up Verizon and social engineer them into telling me the text.
Overall, I'm not certain this is a great idea - using an email for recovery (with 2FA) would make more sense, and using OAuth would be much more secure, while being much less of a headache for you.