Comment by armchairhacker

This is an embarrassing failure for Instagram. But SIM cards have been hacked the same (by tricking support, claiming the phone was lost or stolen), except the agent was human.

The solution (which also solved SIM support agents being bribed or hacking known acquaintances) was to prevent the agents from resetting the SIM card without some steps the original owner would have to follow (and could follow even if they've lost their original phone), like a PIN they'd have to remember. I think the same solution should be applied to AI agents.