Not sure if anyone else has encountered this yet, but I've started receiving text messages from Qantas (three thus far) with the security code for accessing my FF account - when I haven't logged in. Yes, that means the two-step authentication is working but worrying nonetheless