> 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer
Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show?
Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.
Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show?
Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.