Assurance

[Steven Carmody <>]

Hi,

We're in the process of evaluating, moving toward deploying two-factor 
for some applications. We'll probably end up TXTing a code to people's 
phones.

Its now occurred to us that we should require stronger authN when 
someone wants to edit their mobile phone number.

We're wondering what other sites have done to bootstrap themselves into 
the situation where someone MUST have already entered a mobile phone 
number so they can edit their mobile number ...

what's the best practice to get someone started down this road ?