Spliced two-factor authentication setup — users enter their mobile number and must tick the consent checkbox before a verification code is sent.