This is a deep violation that makes every user of 2fa _unsafe_. It's certainly a violation of trust that could make people less likely to volunteer extra infor

This is a deep violation that makes every user of 2fa _unsafe_. It's certainly a violation of trust that could make people less likely to volunteer extra information for 2FA that could be used against them, even if it might also make them safer. For that alone, wilful violations ought to be treated as a serious breach under data protection laws. The number of important financial services I use that now insist on phone numbers for 2FA is getting irritating, too. Apparently in some cases it's been prompted by the changes in EU rules under PSD2, but as with almost everything else I've come across so far under PSD2, I'm not sure how much safer it will really make anyone. At least those financial services -- and my government, which is the other organisation I see doing this routinely now -- probably aren't going to use the contact information for anything other than the 2FA they claim, though.