habilain

Depends how bad it’s broken, doesn’t it? If the phone isn’t powering on at all, it seems like it might be difficult for a regular user to wipe it.

It sounds more like the OTP app was on the phone, and it wasn’t possible to wipe it off before sending off for repair. This is the one way where SMS actually beats OTP apps; it’s much easier to remove a sim card from a broken phone. (Note: Definitely not advocating SMS as a 2-factor authentication method, because it’s really bad for other reasons, mainly because carriers don’t treat it as security critical.)