Why do I need a password and a one-time SMS code to approve a qualified electronic signature?

Why is one SMS code not enough?

For the qualified electronic signature, a 2-factor signature approval means is mandatory due to legal requirements of the Swiss Signature Act ZertES and EU regulation eIDAS. The signature approval means should consist of 2 factors from 3 categories: possession, knowledge, or biometry.

The receiving of an SMS code on your mobile phone represents possession but lacks an additional factor from the other two categories. In this case, a password representing knowledge must be added for approval by a qualified electronic signature.