Box now allows you to use email as a multi-factor authentication (MFA) factor to provide users a way to perform MFA when they don't have their primary factor available (e.g. they don't have their device to receive an SMS or push notification). For certain users, like those in the public sector, using mobile phones or additional software can be restricted or prohibited. Email-based MFA enables you to login to your Box account even when TOTP and SMS options are unavailable.
Box will continue to also offer TOTP and SMS as primary options for MFA, in addition to email, with the user having control around method they prefer to receive their access codes through.
Learn more about MFA here.