OTP not delivered → retry → too many attempts → invalid phone number

The current phone verification experience in Codex/OpenAI is extremely frustrating and needs serious improvements.

The problem is not security itself. The problem is how the security system is implemented.

1. Requiring verification through an old phone number that users no longer have access to is unreasonable. People change phone numbers, lose SIM cards, move countries, or simply cannot recover old numbers.

1. Triggering phone verification too frequently creates unnecessary friction. Security checks should be risk-based, not a recurring obstacle for legitimate users.

1. Failing to deliver verification codes is unacceptable. If the system cannot reliably send OTPs, users should not be punished for retrying.

1. The current flow often creates a vicious cycle:

• The user requests a verification code.
• The code never arrives.
• The user tries again.
• The user still does not receive the code.
• The system eventually responds with "Too many attempts."
• In some cases, it escalates to "Invalid phone number."

1. Legitimate users end up suffering the consequences of failures caused by the verification system itself. This is especially frustrating when users still have access to their email accounts, authenticator apps, trusted devices, active subscriptions, or even the phone number currently being used for verification.

Security should prevent abuse without locking out genuine users.

Suggested improvements:

• Prioritize authenticator apps (TOTP) and passkeys as verification methods.
• Allow recovery through trusted devices and verified email accounts.
• Do not count failed OTP deliveries caused by system issues as verification attempts.
• Provide a clear and transparent account recovery process for users who no longer have access to old phone numbers.
• Design the verification process to distinguish between malicious activity and legitimate users who are simply trying to access their accounts.

The goal of security should be to protect users, not to create additional barriers for them.