[t-writescode]

This doesn't sound like something your average user is going to be doing in most cases - keeping a backup, secondary phone.

We've already successfully gotten people to start using some level of 2FA in the form of SMS-based identity validation along with their password.

That's a pretty impressive step forward, and sufficient for most non-specifically targeted users' usage.

[177tcca]

Until they're targeted.

You can fool carrier customer service with no training.

[t-writescode]

Yes, that is indeed what I said.

edit: everyone has a threat matrix they have to deal with.

[177tcca]

NOBODY is targeted to be robbed until they are — what?