>"Your aunt" does know know or understand the need for "two step verification"
I wonder more and more if we need to make it mandatory in some form, but maybe more formal. Like you can use your phone, but also here is a plastic, officially-sealed set of codes we'll mail to you at a verified address just in case.
