If a site requires you to authenticate with only a phone number and a one time login code, what safeguards can be put in place such that when I change my phone number and the phone company recycles it, that the person who has my old phone number doesn't accidentally or maliciously gain access to my account on that site?
To clarify, the login screen for this site says "enter your phone number", when you do it sends you a text message with a code, the screen then says "enter the security code". Upon doing so correctly, you are now considered authenticated.
I am not sure of a way to prevent a recycled phone number from gaining unwanted access to an account.
This is assuming that the person who actually owns the account has left it without de-activating it or changing their phone number. This is also assuming the daily traffic for the site is in the tens of thousands range.