No the process FIDO has relies heavily on human judgment and screening. Humans make mistakes. There is no process. I'll show you on this example of porting number to a different provider which is slightly different but shows similar issues.
Porting number could open a whole new can of worms because now you have 2 companies dealing with it, old which doesn't care anymore because you are leaving anyways and new provider is happy to get you as a new customer. So why would put any barriers in place.
Until recently moving to a different provider was very easy. I would just call my new provider and that's it. I don't know how much the process changed since and from what I understand - it is left up to the telecom providers to set their own rules of conduct and due dilligence. Is CTS regulating it? They should.
Logging into FIDO acount, adding 2FA is OK measure and it helps.
Here is example of how porting a number is done in Europe.
Ti port my number to a different provider i MUST log into my account *and* write down a special "porting" code to port my number. It's a 12 or more digits number (not IMEI or SIM number), but a special code specifically for account transfers. That code is hiddent and I need to be able to login into the account and know the security answer before it is revealed to me.
I call then the new telecom company, sign up for the plan I want, I'll provide them the "porting code" and they send me new SIM card to my address. SIM cards are FREE and not like Rogers, Fido, Bell etc charging moneys for SIM cards.
On the day when I specify, my new telecom provider will do the porting process. It takes 2-3 days. Yes, it's a bit longer because there is a procedure to follow.
Immediately when the porting process starts, I will be literraly bombarded with phone calls from the existing provider asking for call back to confirm if I really want to port my number. I received text message saying, I need to call them back and unless I call back, the porting process can not continue.
Some telecom providers in Europe (I don't know of any other than some cheap British discount phone providers) not sell SIM cards in the market freely and they would not be activated unless the SIM card is sent directly to my registered address I have on the account.
Once I receive SIM card, I'll call the new provider to complete the activation process.
A while ago I have done a similar port from Rogers to a virtual provider in the U.S. Guess, what, I didn't get a single phone call from Rogers. Nothing. I even faked my signature on the porting application since I didn't have time to print and scan it. Rogers has accepted porting process without any issues.
So all FIDO moderators can do is giv you False hope, try to do damage control and to do whatever can to silence criticim.
The security procedures are archaic. Yes, things have improved, but as I said, the process depends on people following the steps.
Ethereum blockchain will at some point of time in the near future replace contracts including the ones that run with Fido. Yes, blockchain seeds and private keys can be lost. But I would feel better knowing porting of my SIM number is handled by a computer algoritm and a smart contract than by an underpaid employee wanting to go home soon.
I always recommend everybody: Have 2 or 3 phone numbers, one that you use for your bank and CRA only and nobody else, the 2nd number you use for everything else and perhaps a 3rd number (could be virtual) as a trash number. Same approach many of you do with emails...
Until then we have to hope whoever handles my SIM Swap or porting request is a dilligent just enough to use reasoable care.
