Security is always based on some secret that the user need to understand it's vital to not reveal or share. So, if people using 2fa or password reset by sms do

Security is always based on some secret that the user need to understand it's vital to not reveal or share. So, if people using 2fa or password reset by sms do not understand that the secret sent by sms is not to be shared there is nothing that people who implement security can do. On the other side from technology point of you phone number spoofing is more or less hard to achieve depending on the operator you subscribe with. Some have specific anti spoofing features in there sms platform other don't. Anti spoofing include verifying the source cell, IP (in case of sms over IP)...