It's an attractive nuisance. And the SMS request that's actually part of the problem can be misunderstood by users (whose model is understandably less technical

It's an attractive nuisance. And the SMS request that's actually part of the problem can be misunderstood by users (whose model is understandably less technical) as a validation that this is authentic. "Ooh I'm not sure about these texts from Big Bank, maybe I should call them instead... Oh it did the 2FA code text, I guess it's legitimate"