What do companies still use phone numbers for 2FA? This should be an automatic design decision to not use the phone number for anything outside of initial account set up. All the banks use it.