I worked on something similar in the 90s. One of the problems that we found was that people dislike having to answer their phone late at night. (Or making phone calls, for that matter.)

The biggest security risk we found wasn't the second form of authentication; it was making sure it was just as hard to add other phone numbers. Then there were instances of disconnected phones, dead cell phones, etc to deal with.

If these guys can make it all work successfully and be profitable, more power to them; it's an uphill battle for sure.

I'm not working on it any more, so I'll offer some free suggestions to them:

* Offer other means of authentication - biometric seems pretty popular, but you lose mobility. Rolling keycode generators are also nice (and not terrible to implement).

* Double-check your security at the data center. I was working on secure data storage, not email, so the problem set was slightly different. However, there was some technology we were looking at licensing that used a physical air-gap on a router to remove data from the network when it wasn't authorized to be online. Probably not economical for individual email accounts; but possibly useful for bigger clients. As an example, years ago I was talking to someone at a Proctor & Gamble research facility. All of their computers used detachable hard drives (well, Iomega Jaz drives, but still) and at the end of the day, every drive got removed from the computer and locked into a safe. That way if there was an intrusion, the data was totally inaccessible.

* Add an sms interface that would just text someone a keycode (similar to a rolling code generator, but would just require a cell phone).