Other good replies in this thread — I will just add some examples of why SMS-based 2FA is less secure than pretty much any other 2FA method. Example 1: at a fi

Other good replies in this thread — I will just add some examples of why SMS-based 2FA is less secure than pretty much any other 2FA method. Example 1: at a first approximation, 100% people have their phones set to display the content of SMS messages even if the phone is locked. So gaining the physical possession of a phone (even for a brief time) allows the attacker to gain access. Example 2: taking out a SIM from a modern phone takes less than 10 seconds. Again, at a first approximation, 100% people have no PIN on their SIM cards. The card can be inserted into another phone and used to gain access immediately. Note that while you might notice that your phone is missing, you might not immediately notice that your SIM is missing. I'm not even considering other (more complex) ways of redirecting SMS messages. And what I hate most are services which allow you to use SMS or a phone number to recover/unblock your account. That makes it so much easier for attackers go gain access. The only way to recover your account should be with recovery codes. If you lose those, there should be no way to recover.