Up until late 2013, it was very easy to social engineer your way past Customer Sales Rep call screens to gain access to an AT&T account once you put together a

Up until late 2013, it was very easy to social engineer your way past Customer Sales Rep call screens to gain access to an AT&T account once you put together a few pieces of personal data (which was even easier to obtain) of the account owner. You didn't need to know the account password to gain access if you had other pieces of information. Those bits of information leak out through other service providers and are sometimes available through State and Federal Government systems. That meant that anyone using SMS via AT&T for two-factor auth was vulnerable. The extra layer of security is only enabled if you call AT&T and ask them to further protect your account from future changes.