“Do not use SMS as a second factor for authentication”