The scenario confirms a person's identity two ways at once: it reads a code out in a call and sends a second code by email, checking both.