It isn't the telcos, it's the people asserting that SMS is the only way to authenticate someone (my bank does this), it's not only absurd but also horrifically inconvenient as it assumes the number happens to be tied to the SIM in your device, in my case the number is in another country, and ends up on a VM, not my mobile device (I don't give my real number to anyone and I rarely use voice), SMS was never secure since it's readable by at the very least 3 entities, but yet it's treated as such by all sorts of people who should know better but it ticks some checkbox for compliance.