Often we have a patron that will call to do something with their account and cannot because they don't have their card on them or they have lost their card. It would be FANTASTIC if there was a button on the account, for those that have SMS messaging setup, to send them a one-time code that they could read back to us to verify that it is them. I could also see this as a validation process for setting up SMS messaging on the patron (OPAC) side.
I don't know about that first use case, although I suppose it's not that different to authenticating someone by scanning a card (ie something they *have* rather than something they *know*). That could be an interesting Koha Plugin. I like the second use case better. Using it to validate setting up SMS messaging, or being used as a 2nd factor for authentication (ie something they *have* PLUS something the password that they *know*).
I could also see this method via email as well, in verifying the patron, and in verifying an email address (outside of the initial self registration method).