The link knows all.

Research analyzing 322,000 unique URLs from 33 million SMS messages found systemic security and privacy failures in SMS-delivered single-click links: exposed PII across 701 endpoints at 177 services, weak token-based authentication that grants access based on link possession, low-entropy tokens enabling mass enumeration, and data overfetching; disclosure prompted fixes at 18 services improving protections for an estimated 120 million users.