Would it make it better if it was the other way around? If user would send the ramdom code to the authenticating entity by SMS?