content: Being able to transfer a number with minimal information is fucking retarded.  They could also verfiy that the person has access to the number before transfering, which is the crux of two factor in the first place. Unless the attackers get access to the phone somehow, but then two factor would already have been broken.