What is the safest way to communicate the verification code to the user?