Authy doesn't implement SMS 2FA (how could it). A phone number is part of your user profile for registered mobile devices hosting the app.
https://www.authy.com/integrations/ssh/
"Someone in your organization doesn't have a smartphone? We got you covered. Authy SSH can send them the token via SMS or a phone call."
Using the device advertisee ID that the user is entitled to change.
// Sorry, for a moment I thought you were serious.
Ignoring the security pitfalls of phone numbers, it really doesn't seem like these advertising IDs are a drop in replacement for using phone numbers.
> It's used to store and retrieve your 2fa secrets in case you lose your device
The phone number doesn't store anything?
But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem.
Except it often is, and that's the problem.
https://authy.com/blog/understanding-authys-multi-device-fea...
A terrific reason to avoid anything Twilio / Authy