This is a worrying thought! Does someone like Twilio do this? Might be worth having a look. We grappled with the same problem because we do device authenticat

This is a worrying thought! Does someone like Twilio do this? Might be worth having a look. We grappled with the same problem because we do device authentication as a single factor of authentication. In a SME setting, ideally the business signs up using ops@example.com and then they can register any number of devices to carry out the device authentication and remove any device remotely if, say, Barbara from accounts retires on Tuesday.