Whoever Receives the Code Is the Account Holder

How the arrangement works

You give a phone number at registration. To enter, you receive a short code and type it in. There may also be a password, and where there is, it is usually optional or resettable by the same code — which means the code outranks it.

The appeal is obvious: nothing to remember, nothing to lose except the phone, and a channel the user already trusts. The cost is that three separate functions collapse into one. Identity, authentication and recovery all arrive through the same message.

Where it fails

• 1

  The number changesA new SIM, a lost handset, a ported number. The account is intact and unreachable, and only the operator can reconnect them — which requires a support route that is not published here.

• 2

  The message does not arriveCarrier filtering, roaming, a delivery failure. Indistinguishable from the account not existing.

• 3

  Somebody else receives itA shared handset, a SIM swap, a message preview on a lock screen. No password is involved, so nothing else stands in the way.

• 4

  The app is reinstalledCommon with directly downloaded software, and the point at which the whole chain gets tested at once.

What the operator publishes

Nothing. No description of the credential, no reset procedure, no statement of whether two-step verification exists, and no recovery route. The same silence covers the login screen itself and the registration that precedes it.

For an account that holds money, the recovery route is not a convenience feature. It is the thing standing between a balance and its owner when a phone changes, and here it is undescribed in either direction.

What is worth doing anyway

Turn off message previews on the lock screen, since a code visible without unlocking defeats the arrangement entirely. Do not use a number you share with anyone else. And know before you start that changing the number later may be a problem you cannot solve unaided.

The wider question of what actually protects an account here is on the security page, and what happens to the personal data collected along the way is on the privacy page. The overview explains the sourcing rule.