> it's trivial to social engineer phone companies into moving a phone number to a new phone Obligatory "if you're in the US, then yes - elsewhere, it depends".

> it's trivial to social engineer phone companies into moving a phone number to a new phone Obligatory "if you're in the US, then yes - elsewhere, it depends". In the UK, obtaining a PAC code is a bit more complicated/non-trivial for the attacker. I'd consider it fairly safe to use SMS 2FA over here.