As a 2nd factor, SMS would be sufficient in my opinion. There are plenty of cheap services for that.
or they could implement a standard hardware token like U2F
https://en.wikipedia.org/wiki/Universal_2nd_Factor