>The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided

>The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number From a security standpoint, the point of requiring a phone number is to increase the expense of the request -- like a captcha. (Not to say that there is a real security purpose in this specific case.)