SMS verification really sucks. It&#x27;s hugely helpful because it is an &#x27;open social graph&#x27; to use a Zuckerbergism. However, it&#x27;s not at all designed to do this. It&#x27;s like the problem with SSL verifying ownership via email - ok at first sight, but then say you run a webmail service and you can register webmaster@, game over without any crypto bother. Or just trojan the webmaster@ mailbox and get control over the guy that runs it and issue a valid cert. Insta-MITM.<p>Mobile numbers are easy to spoof and easy to port away from people. In most countries telco regulators look at how easy it is to port cell numbers as a badge of honour on how efficient their mobile regulation is. Just like everything, attackers will rush to the easiest point of failure. In this it&#x27;s SMS and using phone numbers as a trusted identifier.<p>In the UK you need to get a &quot;PAC code&quot; to change provider, but it&#x27;s not hard to social engineer that if you went through someones trash and grabbed an old cell bill. The number will be ported in a day or less and even worse, there&#x27;s no way for you to port it back quickly since you&#x27;ll have no idea who it&#x27;s got to. And with it your WhatsApp, etc will all be gone security wise.<p>All this talk of &quot;oh just enable these super warnings and scan QR codes&quot; is nonsense. People port phone numbers and move phones all the time, these warnings can&#x27;t be this strong otherwise half your phonebook would false positive.