We collect the user’s phone number during signup using the Phone Number attribute configured on the database connection, and require phone verification as part of the registration process.
We would also like to use the same phone number for SMS MFA. However, Auth0 appears to require the user to enter and verify a phone number again during MFA enrollment. If the user intends to use the same phone number for both signup and MFA, this seems like unnecessary duplication.
Is there a recommended way in Auth0 to reuse a phone number that has already been collected and verified during signup for MFA, without requiring the user to enter and verify it again?
Additionally, is reusing the signup phone number for MFA considered a good security practice? While it would simplify the user experience, it may reduce separation between profile data and MFA data. MFA phone numbers are typically obfuscated in the UI, whereas the Phone Number attribute used during signup appears to be more directly accessible and visible.