Last time I checked (~6 months ago), when you're logging in and it asks to verify a mobile 2FA code, the mobile number it's sent to is actually returned to the browser in the response...