> even plain vanilla SMS based MFA is better than just a username and password for authentication I'd be careful with this because a lot of services will allow

> even plain vanilla SMS based MFA is better than just a username and password for authentication I'd be careful with this because a lot of services will allow you to reset your password with just SMS verification once they have your number. So while Password+SMS is stronger in practice this usually becomes Password+SMS OR Customer Support+SMS which is decidedly weaker.