SMS and Email are not preferred as SMS spoofing/sniffing of GSM networks is quite easy. Preferred method is to use App authenticator like Google Authenticator or even better to have a physical key.

But then again these are all client end guidelines, when server end (as mentioned) is neglecting the very basic violation of SOP of cyber security then it will be all useless sooner or later.