Not all multi-factor authentication approaches are the same. Pre-issued one-time-passcodes are vulnerable to hacking, i.e. through unauthorized usage or theft of seed files. Mobile apps are cool and most users are familiar with using them on their smartphones, but as an authentication mechanism, the coolness of the mobile app will quickly fade once an organization starts deploying it in the real world. Mobile app (unless it uses a basic soft token) requires a data connection to work.”]
Source: https://www.csoonline.com/article/2458701/the-hidden-dangers-of-good-enough-authentication.html