At the other end of the scale and a slight thread drift. {That's OK, I approve. [signed] S.o.S.}
A finance company I do business with, I needed to change something on my personal profile. I was glad that they wanted two step verification to ensure that it was me and that included a pass-code sent to my mobile.
After I had logged in, I went straight to alter the item and the site then asked for two-step verification and sent another code to the same mobile phone as they had two minutes earlier. Given that their system could easily tell that it was the same me, on the same computer, in the same session? Their IT systems are often so cr@p that they need multiple entries of address and other data. It would not surprise me that they cannot keep track of clients and might easily have multiple address' for one.