The second scenario is kind of an actual thing. Think about this for a second... Your grandmother has a caregiver who has looked over her shoulder and knows she banks with BigBankX, and she keeps a little book of passwords by her computer because she is forgetful. Caregiver goes home and tries to log into the website with Granny's credentials, but it asks for the code from the text message. Now Granny knows someone tried to log in to her account.