Is the AWS account phone number also their phone and not the business/corp phone? And you tried the dedicated lost MFA device form?