the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system.
My administrators will log in to the system via our corporate network, and then an OTP will be sent to his email which he will use to enter the system.
However my colleague is for the OTP to be sent to the mobile phone. I said that even if he is going to use a mobile phone, he is still going to be in the internal network to key in the OTP. It will not differ much because the email server is also in the internal network. I also mentioned that it's much easier to lose a mobile phone, whereas an email server won't fail that easily since it can be running in redundancy.
What are your opinions? Does more secure organizations today rely more on mobile phones for OTP?