Why shouldn't you allow phones to be used both for password resets and multi-factor authentication in AWS Cognito?

Question

I'm going through the User Pools setup process and there's the following sentence under the MFA and verifications page:

We recommend not allowing phone to be used for both password resets and multi-factor authentication (MFA).

What's the reason behind that recommendation?

Answer 1

If the password reset and MFA are both sent via SMS, it's not true MFA. You want MFA to be configured on a different channel so an attacker who has your phone or SIM cannot reset your password and get an MFA code.