I've often read that 2FA should be through an authenticator app or a physical key, not via texting a code to a phone number. Malicious sim swapping is a thing, so purposely deleting any phone number from an account should be good practice, right?
So will they also delete inactive accounts that have no phone number, but one or more phone-less 2FA methods associated?
So will they also delete inactive accounts that have no phone number, but one or more phone-less 2FA methods associated?