Valve and a few other gaming companies will use email. I have seen one financial institution use email as well. SMS seems to be more widely adopted. I should clarify and mention when I say only option, I mean for the end-user. Companies could in theory implement anything if they prioritized it.

In my personal experience, email is often accepted. But that wasn’t my point. You said SMS is often the only option, but I don’t see why companies couldn’t support email as well.

Edit: I guess my point is that since this post is essentially asking what should be prioritized, I think that companies should prioritize providing email as an option if they provide SMS.

Agreed. I can add TLS checks on my mail server to validate where mail is coming from for specific domains. I would love to see more companies support this option.