[edent]

The flaw is "Thanks - we've texted your 2FA code to [phone]."

That's primarily to tell the user which phone to check - which isn't a bad thing.

They should probably fix it by saying "we've texted your 2FA code to the phone number ending 171" - or similar.