Many of us cannot use personal cellphones at work, do not have company cellphones or do not have phones that enable texting at work. It is only fair to allow email authentication (which is widely used in the rest of the world) as part of the two step MFA process. Otherwise, we are forced to invade the private devices of employees or break company policy. Blackbaud's changes should not force clients to download suspicious third party apps or expend valuable resources in purchasing third party devices or hire help to set up other complex systems.