What I meant to say was, there needs to be a cut-off point for company responsibility. Agree, there should be other alternatives to SMS incase a user get locked out.