Running VIP Authentication Hub, when the user account has no mobile attribute, still in the User Interface (UI) "Text security code to my phone" is shown.
If the user clicks on it, he's redirected to mail OTP. Is this still necessary to show the option in this case?
This is expected behavior when online enrollment is on.
The user must first validate a mail OTP, then he can register his phone number.