Why do services still rely on phone numbers for account verification?

Caller-ID spoofing doesn’t normally let someone receive calls or texts sent to the real number. An attacker can pretend to be calling from another number, but they generally still need access to that number’s device or carrier account to receive a verification code. That makes SMS verification imperfect, but not completely defeated by ordinary spoofing.

Companies generally choose authentication methods based on the risks they’re trying to manage. Getting control of someone’s phone number is an extra hurdle for many attackers, and SMS codes are familiar and simple for users. For higher-security situations, services are increasingly encouraging authenticator apps, passkeys, and physical security keys because those are harder to intercept.

Phone numbers are nearly universal, so they’re a convenient way to reach most users without requiring them to install an app or understand security keys. They aren’t perfect security, but they’re usually better than having no additional verification at all and are relatively easy for companies to deploy.