Phone verification

A verified phone number can act as a fallback second factor and as a recovery channel for the rare case where a user has lost both their password and their TOTP/WebAuthn device. Verification is the standard "we text a code, you enter it" flow.

SMS as a primary 2FA factor is weaker than TOTP or WebAuthn (SIM-swap attacks, SS7 issues). NimbusNexus supports SMS 2FA but defaults to TOTP for new enrollment; SMS is offered as the recovery-only path for production-tier accounts. Enterprise accounts can disable SMS entirely if their threat model excludes it.

What's next

• Two-factor authentication — the primary 2FA setup.
• Users — the resource phone numbers attach to.