Your comment still doesn't make any sense. Either you want the highest verification tier and go with phone verification, or you don't. It's your choice as admin. As a user you can just delete the phone number from one account and use it to verify another... you will have a timeout [2] but both accounts will be verified. Is it annoying? Yes. Is it understandable to rate limit it? Yes. Is it impractical? No.