Token based 2FA, either via something like google authenticator or a USB dongle like a Yubikey or RSA token. The point is to prove that you have possession of

Token based 2FA, either via something like google authenticator or a USB dongle like a Yubikey or RSA token. The point is to prove that you have possession of both knowledge and a physical token (hence two factor). And while sms to phone makes it seem like you are proving possession of the phone, you’re actually proving that you have the phone that texts will route to. That last bit is movable and subject to shockingly little security, hence the issue.