No, that wouldn't work. The server wouldn't know if the random number they got back really came from the correct phone or was spoofed. The only thing the servwr can control is where it sends the code to - so the best security is sending it to a different device from the one the attacker might be using, the computer.