I'm designing a strong authentication (two factor) solution for a website. Users will be forced to use two factor (legal requirement).
We have two supported methods an SMS verification code texted to your phone and a TOTP mobile app token generation algorithm (like Google Authenticator or Authy)
Preliminary feedback is that users like and are comfortable with SMS verification. However, the business would like to "encourage" download and use of the mobile app.
Its going to be faster and easier in the long run since it works when you don't have a data connection, and its faster than waiting for a text
Its cheaper - don't have to pay to send that text
So the design question is, how can I encourage users to set up this form of strong auth that they may not be as familiar or comfortable with?