OTP authentication stuff up

Whilst travelling outside RSA for an extended period I needed to request a copy of our medical aid contributions tax certificate from Discovery. As is so often the case nowadays where businesses want you to jump through the hoops with so called security checks they want to send you an OTP to view the document requested. So how do they send the OTP? To one's SA cell phone number which unless one is roaming is useless if outside the country. Come on Discovery, use your heads before introducing such dumb ideas. Why not use the customer's email address for this. And what makes you think the cell phone is in the owner's hands and not some *****???? One wonders where these IT guys went to school.......