100% Banning SMS 2FA is the wrong approach, because it is better than no 2FA and every cell phone supports it, out of the box. What should be mandated is (a)

100% Banning SMS 2FA is the wrong approach, because it is better than no 2FA and every cell phone supports it, out of the box. What should be mandated is (a) giving users choice of a non-SMS 2FA method (probably just pick one for a standard, e.g. TOTP) & (b) allowing users to explicitly disable SMS 2FA on their account. As a least common denominator, SMS is fair. But there should be an option to do better, securely, if a user wishes.