[jasode]

Whitelisting doesn't work if one doesn't know the email domain name the service will use.

An Amazon verification email will be sent from "[e-mail]". It's intuitive to predict "@amazon.com" so whitelisting works.

However, State Farm Insurance login verification codes are actually sent from "[e-mail]" instead of the "@statefarm.com"