SMS login security invariants: pass