The security community has long called for "not using phone numbers as the sole verification factor," and the original design intent of multi-factor authentication (MFA) is precisely to prevent a single identifier from bearing excessive security weight.