If you’re going to start requiring 2FA (please do!), when you build plans to verify accounts - make sure to validate your assumptions. Even if you’re a phone company, can everyone receive SMS? Maybe that shouldn’t be the only option for account verification.