Same problem. A good login mechanism needs to rely on a "previously agreed upon" mechanism to perform the login and not break because an SMS or email is delayed. A password works this way. TOTP/HOTP 2FA also works this way.