+1 for MFA, but SMS MFA is costly (twilio (referenced above)) for example is ~$0.007 per transaction in the USA, outside USA, looking at $0.02 (canada) etc...
TOTP (google Authenticator) or e-grid (bingo card) would be best/ easiest / cheapest to implement, with no external dependencies.