They can implement it like some banks have, where they e-mail, text or do a voice call to a verified number/email they have for you that you have to use to get access from a new machine.

Before you can access your account from a new device, no matter what the device, the first time, you have to enter the passcode they sent.