Why is a one-time code sent to a phone number only as strong as the carrier's recovery desk?

## Address versus possession The whole answer turns on one distinction. A hardware or platform authenticator holds a private key that never leaves the device; proving the factor means the device performed an operation it alone could perform. A code texted to a phone number proves something much weaker: that whatever equipment the number currently routes to received a message, and that whoever was holding it typed the digits back. A phone number is not a thing anyone owns. It is an entry in a carrier's routing tables, leased to a subscriber and changeable by the carrier at any time. That makes the factor's real security boundary the carrier's account-administration process — a boundary that sits inside a company you have no relationship with, staffed by people who have never heard of your organisation. ## The two ways a number moves **Port-out.** Number portability is a regulated consumer right: subscribers may take their number to a competing provider. The receiving carrier requests the port using subscriber details — name, address, account number, sometimes a PIN — and the losing carrier releases it. An operator who gathers or is told those details can initiate the port, and the legitimate subscriber's handset goes dark at the moment of cutover, often the first sign anything happened. **SIM replacement.** A subscriber whose phone was lost or damaged asks for the number to be provisioned onto a new SIM or eSIM. This is completed over a phone call or in a shop, on identity checks that are usually knowledge-based, and it exists precisely because losing a phone is normal. Both are the technique this leaf is about, pointed somewhere unexpected: a phone call to a service desk, no gateway anywhere on the path, and an ask — *my phone was replaced* — that only a live conversation can make credibly. The target of the pretext is not your employee at all. It is a carrier agent whose job is to keep customers connected. ## Recycling, which needs no adversary at all Carriers reclaim disconnected numbers and reassign them to new subscribers after a holding period. If an account's recovery address is a number the user gave up two years ago, the codes now go to a stranger. No pretext, no call, no crew — just an account whose second factor quietly belongs to someone else. This is a good detail to raise, because it shows you understand the factor is an address with a lifecycle, not a possession. ## Getting the direction of the claim right A delivered code proves that the number is currently routed to equipment somebody answered. It does not prove: - that the enrolled account owner is holding that equipment; - that the SIM behind it is the one enrolled; - that the number has not changed hands since enrolment. The same correction applies to a very common recovery design: *call the number on record to confirm the request.* If the attack moved the number, the number on record is answered by the operator, and the callback confirms the compromise rather than detecting it. Out-of-band means a channel the organisation binds to the account — a challenge to an enrolled device, or an approval submitted through an authenticated internal workflow — not a telephone number that a third party can re-point. ## The control classes that change the precondition Rank them by what they remove: 1. **Bind the factor to a device-held key.** FIDO2/WebAuthn credentials, or an authenticator registration tied to a specific device, cannot be re-issued by a carrier because no carrier is involved. Re-pointing a number gains nothing. This removes the precondition rather than raising its cost. 2. **Take the number out of recovery, not just out of login.** Organisations frequently move users to an authenticator app and leave SMS enabled as the fallback, which preserves the weakness exactly. 3. **Lock the number where it must remain a factor.** Most carriers offer a port-freeze, number-lock or transfer PIN on the subscriber account. It is a control at the third party, so it has to be asked for. 4. **Add friction on number changes.** Treating a change of registered mobile number as a security-sensitive event, with a delay and notification on the account's other channels, costs the operator the tempo this technique depends on. What does **not** help: longer codes, shorter validity windows, or sending the code by automated voice call instead of text. All three keep the factor bound to the same address, and it is the address that moved. ## What a strong answer sounds like "A number is an address a third party assigns, so the factor inherits that third party's recovery process. Porting or re-issuing the number is a normal customer operation done on knowledge checks, and it delivers every code to the operator. So the fix is to bind the factor to something the device holds, and to stop treating a callback to the number of record as proof of who is on the line."