> But there are still two factors usually not. The problem with SMS 2fa is that once a company can do it is almost always easy to social engineer them into re

> But there are still two factors usually not. The problem with SMS 2fa is that once a company can do it is almost always easy to social engineer them into resetting the password based on only being able to pass the SMS 2fa... which is a big problem because SMS 2fa has no security against a moderately committed attacker. The only way you can protect yourself is to refuse to give online services a phone number.