i never activated google's 2factor authentication just out of fear of my phone being stolen. this ugly possibility never even occurred to me. i really cannot understand why this stupid sms-based scheme is pushed down our throats by google.

fingers crossed for your friend, i hope it works out!