This
XXX will be rolling out improved security on your account from the 28 September 2016. This will be done using a one-time password function - additional security that is commonly used to combat cyber-attacks - to protect you from the risk of identity theft. XXX will implement this using a one-time 6 digit code that will be sent through SMS to your mobile each time you logon. This will happen after your first successful logon on or after 8am GMT on the 28 September 2016. When you receive your code, make sure that you use it within 5 minutes to continue to access account details as normal.
Sounds to me like a disaster.