PayPal’s free digital wallet service has come up with major service changes that address vulnerabilities as a result of one security researchers experience. Martin Vigo noticed that when the wallet was used, the SMS feature kicked in even though it had not been explicitly authorized. Vigo contacted the company and after some hemming and hawing it pulled the SMS notification feature from the product in its entirety. The company also implemented a rate-limiting mechanism allowing users to try only up to five codes every five minutes.”]
Source: https://securityintelligence.com/news/venmo-wallet-can-be-drained-by-sms-use/