A service I'm building has this option. Puts protection against SIM/email jacking or social engineering into the hands of the customer if they feel capable.