If you are allowing MFA from SMS you should probably not do that.