Well, this is concerning. Phisher's are apparently targeting Apple users by phone number to inundating them with dozens of modal on-device password reset alerts

Well, this is concerning. Phisher's are apparently targeting Apple users by phone number to inundating them with dozens of modal on-device password reset alerts, with allow or disallow buttons, that must all be dismissed to continue using your device -- if a user accidentally clicks allow on any of the alerts, the user loses control of their account. Apparently a bug in Apple's rate limiting for such requests makes this possible. To further convince the user of their legitimacy, phishers spoof a follow up call from Apple's phone number, which the iPhone, having a default Apple contact with that phone number, presents to the user as a legit Apple call, where in they try to convince the user to read aloud a legit Apple MFA code to "verify identity," and take control that way, instead, if the first gambit didn't work. I get the rate limiting bug, but why on earth would Apple let these alerts stack? The default Apple contact on our phones coupled with the possibility to spoof seems like a social engineering nightmare -- Apple, maybe require SHAKEN/STIR verification for at least that contact, or only allow calls from that number if Apple Support sends a verified push notification first of impending call?