There's a few reasons to do it: 1) Provide an additional time-consuming, potentially slightly costly and hard-to-automate barrier to negate spammers (like Gmai

There's a few reasons to do it: 1) Provide an additional time-consuming, potentially slightly costly and hard-to-automate barrier to negate spammers (like Gmail does during signup). 2) Verify that someone controls a number before using it as an interface to your app either through notifications or control (adding appointments or tasks, etc). Like you mention there's no way to use this method to verify someone is who they claim to be. But there aren't really any methods for this type of thing that can't be spoofed.