We are using passwordless authentication for our users and we are linking SMS and email users (primary is the email and SMS is a second identity).
As part of the brute force protection, when the SMS identity is blocked, we don’t get any notification, unlike the email identity where the user gets an unblock email.
Our team is going back and answering some of our frequently asked questions.
This is not a bug, to address this, we recommend using log streams to utilize the log events related to the blocked SMS identities. You can then set up an Action trigger with a log stream provider to notify your admins when an SMS identity is blocked.