Turns out 2FA is also being used as a low-effort form of a captcha in addition to being a tool for data harvesting and “device identification”. I wouldn’t be surprised if legitimate users simply never receive a 2FA SMS because someone used a prepaid phone or something.
I'm sure there is some good reason to want to avoid people spinning up free or ultra low cost phone numbers to make extra accounts but some users were like, "I've been using TracPhone for a decade" or something like that. Also pretty surprised that it's this easy to detect the carrier. Guessing we'll see this more and more!
I have only ever used prepaid cards. I would rather be cut off from communication (or buy a local prepaid card) than get a surprise bill of hundreds of euros for visiting a country outside the EU.
I guess a lot of people have the same thought process as me around Europe, because there are lots of smartphones available with dual SIM cards.
I pray for the rise of esims! I feel like it's on the cards.
You still need your phone and cell signal to receive them (at least many European carriers don't support SMS over VoWIFI); the eSIM is "stuck" in your phone if it physically breaks (and on many carriers, you can't re-use an eSIM QR activation code in any case); in many countries, SIMs expire after a couple of months or even weeks of inactivity, losing your number permanently, to name just a few.
I've found Google Voice to work quite well as a workaround for almost all of these problems, but unfortunately, many US companies insist on not allowing VoIP numbers for 2FA or even plain account creation purposes. I usually try to avoid these companies.
Wait, does this happen?
You do need to be able to receive a texted code at a phone number to create a brand-new account. This is to deter spammers from creating lots of accounts. But once that's done, you can remove the phone number from the account.
I also don't use my phone much, and the only reason I even have one of those things is because it's "needed" for so many things.
Yeah I have no idea why phones still use numbers. It would be so easier if same address for e-mail worked for voice, just add some DNS records that point at my phone provider to domain and done.
Then again, spam calls would probably be so much worse...
