On: Companies embracing SMS for account logins should ...

[Hobadee]

Surprised nobody has mentioned NIST SP 800-63B §5.1.3.3.

SMS based authentication is explicitly insecure and not allowed.

https://pages.nist.gov/800-63-3/sp800-63b.html#pstnOOB