Time-based one-time tokens enable second factor authentication anywhere, even if your user can not receive an OTP on their mobile or desktop because they're offline or out of data. Your users can still login securely because each token is generated from a device specific shared secret, allowing you to make risk decisions per user device.