As I noted in another comment, I don't think this is the right solution. I would argue that things need to be tied to an identifier other than the phone number

As I noted in another comment, I don't think this is the right solution. I would argue that things need to be tied to an identifier other than the phone number. Therefore, if something does happen, it's much lower friction to simply reset the identifier. To deal with some of the UX pain, one could force a voice call requirement instead of just a fingerprint reverification.