Hi @woz,
Welcome to the Auth0 Community!
Generally, SMS alone isn’t recommended for user authentication. We suggest protecting your users by requiring MFA on SMS passwordless accounts. This would reduce risk of intentional account takeover or inadvertent account takeover (due to recycled numbers).
Further reading: Passwordless Connections Best Practices
Hope that helps!