Accor just sent me an email saying this: "​By activating two-step verification via SMS, you add an instant, unbreakable shield to your account. It takes less than 60 seconds to set up, ensuring your personal details, booking history, and points balance remain exclusively yours.” I think they're overselling the security of SMS two step verification, and underestimating the number of users who might lose access to SMS while travelling.