Short answer: for an e-commerce login risk scorer, keep email and phone verification as separate, auditable recovery factors; choose the channel from the device-risk decision, and preserve an already verified factor until a deliberate recovery ceremony replaces it. Delivery speed is only one term in the bill. The expensive failure is an account that cannot be recovered or cannot be reconciled after a provider migration.
A device fingerprint is evidence, not identity. A new browser, a changed network, or a reset mobile identifier should raise a score, but it should not silently erase the account's recovery history. In payment and ledger work, I treat every verification attempt like a tiny financial event: it gets an idempotency key, an immutable audit record, and a clear expiry. That exactly-once mindset is useful here because duplicate sends and duplicate callbacks are normal, not exceptional.
What the delivery bill hides
The visible metric is delivery rate. The bill is made of more parts: messages sent, carrier or mailbox filtering, retries, support contacts, fraud review, and the retention cost of keeping evidence long enough to explain a decision. A phone code may arrive quickly but be unavailable after a number change. An email code may be delayed by filtering but remain reachable from a user's established mailbox. Neither channel is a universal fallback.
