The other potential issue is the age of the users.
Magic emails might work for general users, but for an 80yo who struggles using a mouse. Teaching them to click on links in emails is probably not the best practise.
Their age also makes them greater targets for social engineering, and asking for an SMS code probably sounds pretty harmless. I’m not sure how secure the original poster’s site needs to be, but I think this would be sketchy.
Their age also makes them greater targets for social engineering, and asking for an SMS code probably sounds pretty harmless. I’m not sure how secure the original poster’s site needs to be, but I think this would be sketchy.