Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (ev

Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m... [2] https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg [3] https://youtu.be/bjYhmX_OUQQ?t=98 https://youtu.be/bjYhmX_OUQQ?t=98