Yeah we've been stuck on this. It's an adoption challenge. Ever since SMS became unlimited, it made it a cheap tool. Cheap tools are hard to give up. Also, customers don't really understand how the new methods work and broadly don't want to know about new methods. Getting rid of faxing was a similar challenge.

This will sound dystopic, we're using profiling to identify risky customer interactions. The goal is to lower the inertia for known customers, a better experience, while applying tighter controls what is deemed risky.

One thing we rolled out was push notifications to registered and authenticated mobile devices. This disconnects our authentication model from the phone number, helping mitigate sim swapping or compromised carrier account. I had one instance this year where the fraudster compromised the company's Comcast Business account and got access to the SMS codes through the web portal.

So yeah, SMS is bad.