[aes]

Assuming the phone isn't locked.

A combination with email confirmation plus two-step verification like Google Authenticator could work as well.

[parsnips]

If the attacker has the phone, the second factor (typically sms) won't work very well.