Sign-in codes sent to your mobile could stop being delivered during a busy period, with nothing to tell you why. A limit meant to slow down abusive traffic was being applied to the step that hands the code to our messaging system. Because every one of those requests comes from the sign-in service rather than from your browser, they all counted against a single shared allowance — so once roughly forty codes had been sent across all customers within a quarter of an hour, the next person to ask for one simply never received it.
That limit no longer applies to code delivery. The protections that actually matter are unchanged and were never the problem: there are still ceilings on how many messages any one number can receive, a daily cap on messages overall, and premium-rate and satellite ranges remain blocked outright.
We also shortened how long an internal delivery request stays valid and made each one single-use, so a request that is intercepted cannot be reused to send further messages.