banks can buy port and number db data directly from carriers and refuse to authorise sms mfa (not calling it 2fa because phone/sms mfa is dogshit) from recently ported or modified numbers