Wow! The average person doesn't realize SMS MFA is the worst form of MFA. This is bad news if true.
"A researcher contacted Information Security Media Group on condition of anonymity to reveal that texting "STOP" to the Twitter verification service results in the service turning off SMS two-factor authentication.
"Your phone has been removed and SMS 2FA has been disabled from all accounts," is the automated response.
The vulnerability, which ISMG verified, allows a hacker to spoof the registered phone number to disable two-factor authentication."
https://www.bankinfosecurity.com/twitter-second-factor-authentication-has-vulnerability-a-20475
#mfa #twitter