Yes, this is two factor authentication, and it adds significant security.
To me this seems like just another point of failure for a social engineer to take advantage of.
This is not adding another weak point. It is adding another layer of protection.
We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication before.
It is not 100% perfect. Nothing is. But it is a big improvement over just using a single factor.
There are almost daily report of huge data breaches with passwords in plaintext all over pastebin. Attackers write scripts to automatically test these credentials against different services to steal valuable information. Do you think they will go through the trouble of attacking your site, when they will have to make a phone call to transfer a phone number they might not even have for every single account they want to breach? No.
I also suspect that in many countries, phone companis who just transfer a number like that without any verification could be held legally responsible. Again, just because a system has been broken under some circumstances does not mean it is completely useless.
Also, Is what I am describing two factor authentication still? Or is it something entirely different?
Unless I am missing something, this is plain old 2FA. The password is something you know, the phone is something you have.
To clarify, every time you login these steps will be taken. [...]
Some points here:
- Make sure it is not possible to get the system to tell what phone number a user account is connected to.
- Why do you have to reenter the phone number? That should already be stored in the database, right? (I am asuming each account is connected to a phone number, otherwise this is sort of pointless.)
- You say that if you can't verify the phone number, the system logs you out. I would say that you should not be allowed to log in until you have verified the phone number.