Each person signs in with a one-time link, once per device. Lost a phone or got a new PC? Make them a new link. Links last 14 days if unused.
PIN — shown once. Tell them by voice, never in the same message as the link.
Send the link by text or email. It works once, on the device that opens it; the customer's people also enter their PIN.
