A hardware token step-up is required on paper, but the mobile fallback policy silently downgrades privileged actions to SMS

Administrators believe strong authentication protects the action, yet one fallback rule lets the mobile app satisfy the control with a weaker factor.