That’s exactly how it always worked here in Ireland.
Someone sends an a number porting request online, on the phone to a customer care agent or in a store and the first step is you get a text saying “You have have requested to move your phone to a new network. Your confirmation code is 1A2B3C4D (random one time code).
You can’t complete the port without that code and it’s not based on any personal information and the database access is standard, and operated by a shared porting service provider, so the operators can’t override that.
You need physical access to the handset / SIM to get the code.
If the phone is registered, they need your billing account number for extra step verification.
It’s not perfect, but it seems like a simple and obvious security step to use a one time code.
The port is entirely automated and usually completes almost instantly, but they’ll allow up to two hours and the text alerts you that it’s being ported.
Contacting your current provider can also immediately block or reverse a port.
Landline / VoIP numbers all have a UAN (Universal Account Number) associated with them, which isn’t the billing account number and has to always be available to the customer. (You don’t have to ask permission to port or engage with the previous provider).
To move the number you need to provide the new provider with the registered address, customers’ name and the UAN. That’s also usually completed very quickly these days, but it’s a bit clunkier than mobiles.
The porting system uses a shared database here with a specialist porting service provider similar to a domain registrar, so when you port it just amends the routing information and it syncs up with every provider - comparable to a DNS record. It at least means the porting process is not really in the operators’ hands and there’s an external entity dealing with the system and standards.
If there’s an error / fraud undoing the port isn’t challenging.
In the early days, around 2000-2002, recently ported numbers used to sometimes take a day or so before every provider had synced up. You used to get routing errors until that happened. Technologies moved on and the old TDM based switches and IN solutions are gone, so things have become a lot more instantaneous.