Yeah also expecting everyone to have a mobile phone is a bit elitist. Mobile phones aren't a public service and as such should not be required of user. I stayed in London with no phone number for 4 month after moving in (call it a social experiment or procrastination, it's probably a bit of both). Life is hard. The number of services that require a phone number of you, sometime for no reason, sometime for 2FA is staggering. You have to fight the system so much.

On top of that, your phone might not have battery, forgotten somewhere, died etc.

I think a simple password + fingerprinting measures (recognising the user based on his browser, IP, machine, behaviour etc.) to enable further checks (2FA with either mail, phone, device, security questions), and further messages in the future in case the attacker had access to that creates a better user experience / risk factor.