[kradem]

< What happens if you change phone numbers and it gets recycled? Now a new user installs Lyft and my credit card is already on file! How can this possibly be justified?

There's an account you may access if you know the username and respective password or if you may access account's primary email.

So, just think of the account as your locker in Lyft's building. When someone with your telephone number enters that number and enters back received code, that implies he's the owner of the number.

The credit card is still under your account and there could be no relation to the other user's telephone number. The triggered routine would confirm the connection of the user and their telephone and nothing else.