Phones in general are ridiculous for authentication. You can spoof nearly every bit of data, and there's no way to know, and little weird bits of flotsam like

Phones in general are ridiculous for authentication. You can spoof nearly every bit of data, and there's no way to know, and little weird bits of flotsam like this float to the surface occasionally and make it even worse than it normally seems. If only I could ask them what their favorite restaurant is, maybe we'd finally have two-way verification. Nobody else picked McDonalds, right? That's a safe choice?