Not sure when you worked there, but I’ve seen that you have to enter a number that’s displayed on the device logging in, and the authenticator app shows the location of the device attempting to login as well.