An increasingly common process for assisting with password resets is the application texting a code/token to the user’s verified mobile phone.
We have a client which would like to eliminate the need for the user to remember the code and instead send a bitly link via SMS where the code/token is embedded in the bitly link. This way the user can just touch the link in the SMS message, which will launch their mobile browser and they can proceed with the password reset, possibly with an additional verification with security question or other PII data point.
Is there a reason the above process isn’t being used by the likes of Facebook and Google and instead they continue to just send the code via SMS? It seems, at least on the surface, to just add an unnecessary step of memorization for the end-user to transfer the code from SMS to mobile browser.