>More specifically, the flaw is to do it on the back of an easily-faked, CYA letter of authority. The company the OP used bears a large part of the responsibil

>More specifically, the flaw is to do it on the back of an easily-faked, CYA letter of authority. The company the OP used bears a large part of the responsibility for the issue due to the intentional or negligent lack of validation. Several years ago, I built an application that offered similar ability to the one that caused the recent ruckus. In our case, we worked with industry groups to define an acceptable flow, which led to a one where we initiated a voice call to the customer that read a numeric code to them, which they had to enter as part of the registration process. We also checked each number to make sure that we were ONLY registering landlines and not mobile, toll-free, or other MVNO-associated numbers like Google Voice, etc. (We did support toll-free, but that required written LOA and manual verification with toll-free # registrar). The surprising part to me in the carrier's response was that they weren't already periodically reclaiming SMS routing for their numbers. Over the course of testing, I'd accidentally claimed my own cell # (Verizon) or the cell # (T-Mobile) of one of our test phones, and proper routing was always restored within a week for Verizon, and within a day or two for T-Mobile.