https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s... The fact that they disable SMS

https://authy.com/blog/understanding-2fa-the-authy-app-and-sms/ https://authy.com/blog/understanding-2fa-the-authy-app-and-s... The fact that they disable SMS authentication for accounts that they deem "high profile" says it all. Last time I looked, I don't recall there being a backup password (essentially a local encryption). If you SIM swap someone, you'll pull down their OTP seeds, but won't be able to read them without that code... so that's a slight improvement at least. BUT! They have a recovery process. So the risk profile is convincing the telco to SIM swap + lodging a support ticket with authy (that takes 24 hours to complete).