SMS can add verification, but numbers change ownership and codes can be socially engineered. Account for these limits in sensitive flows.
Evaluation approach
Limit attempts, lifetime and account scope. Treat phone-number changes as security changes.
Application example
Adding a new number may require extra evidence from the existing account. Use a code only for its intended purpose.
Limits and considerations
SMS access does not establish device or application integrity.
Which operation may use the code?
A login code must not authorize a different operation such as changing the registered number. Define account, purpose, lifetime and old-code behavior after resend.
Checks and decisions
- Limit attempts
- Bind purpose
- Strengthen number changes
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.