> and you get a SMS as you expected during the login process They could also ask you to enter the code from your hardware token, and accept whatever code you t

> and you get a SMS as you expected during the login process They could also ask you to enter the code from your hardware token, and accept whatever code you type. Phishing is a different story, not really related to SMS. > Also, in most countries with any sort of number portability a minimum wage employee at a phone store is authorised to override this I don't know about other countries, but here in Israel when you port to a different network a code gets sent to the number you're porting, which you need to provide to the new network. Where there might be an issue is if you claim to have lost your SIM card. This happened to my wife recently - they did give her a new one in the store, but I instantly got an email telling me about it, so it's not so easy to do that undetected.