I use the InvestNow platform for part of my investments.

Login to their website requires 2 factor authorisation with a choice of a code via text or via email.  There's no option for authy or google authenticator or the like.

I 'm wondering:

• which is more secure, text or email for the code
• how secure is either of them
• how difficult would it be for them to implement an authenticator to generate the code
• other options.