Sibling comment says "the cuatomer", yet I'm not seeing how either the customer's SMS provider is not at fault if they did not sufficiently authenticate the customer when sending an SMS to a scammrr's device instead, else Coinbase for allowing SMS as an authentication mechanism.