Hacker News Reader

This is essentially just two-factor using email... give me your phone and I can steal anything I need.

Assuming the phone isn't locked.

A combination with email confirmation plus two-step verification like Google Authenticator could work as well.

If the attacker has the phone, the second factor (typically sms) won't work very well.