Google does a variant of that for one of my (rarely used) email accounts. On every day I attempt to log in, they throw a coin. Heads they let me in, tails they don't let me in unless I provide a phone number.