SMS-based authentication is convenient, but it's also a leading source of fraud, Microsoft says.