Do they even charge for the phone app?

I guess if your sans a smartphone this would still be an issue, but I don't use the one time password and I just suck it up when I have a IP issue that leads to a password reset. I'd much rather that then my account getting jacked overseas.