I agree with most people that calling to reset password should be a service that can be entirely disabled, or at least require 2FA. But think about this. All of

I agree with most people that calling to reset password should be a service that can be entirely disabled, or at least require 2FA. But think about this. All of this could have been avoided if they had the simple policy of calling you back. The only thing you would have to do as a user, would be to keep your number up-to-date. Of course this also requires that you should never be able to add a number using the phone though, but this makes sense, since they can just say: "To do that you just have to sign in and click on..."