This is a modest but often overblown risk. SIM swapping is easy but scales badly. SMS interception malware exists but isn’t widely installed and you rely on the

This is a modest but often overblown risk. SIM swapping is easy but scales badly. SMS interception malware exists but isn’t widely installed and you rely on the malware not being able to root your phone or get accessibility access to your screen. But most importantly, both TOTP and SMS are vulnerable to phishing - by far the most common method of stealing second factors.