It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who can access the phone or even seen it.
I know you can change this setting so that the preview of an incoming text message is not displayed on the lock screen, but most people don't do this (and saying that users "should" do it isn't going to fix anything). (And for incoming messages generally, it's often convenient to see them before you unlock the phone.)
It seems that for the service itself, the safest option would be to pad the beginning part of the message containing the code, so that even if someone can see the initial portion of the message displayed on the lock screen, they won't see the code. (If the user is receiving an authentication code, I don't think it's asking too much of them to actually unlock their phone instead of just glancing over at it.)
And yet I've never seen this anywhere on a list of recommended best practices, and I've certainly never seen any service actually doing it in the text messages that they send out containing authentication codes. Any reason why it wouldn't be a good idea?
Long-term, should there also be a protocol to mark a text message as "private" so that the preview should not be shown on a locked device? (It could be as simple as putting "PRIV:" at the beginning of the message.)