I had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't con

I had been assuming that cloning was very unlikely, yeah. It seems substantially harder than actual redirection or capture would be. But honestly, I hadn't considered the possibility that they triggered an SMS and then got access later, maybe with a second (rerouted) SMS. That's a good point.