Like everything in computer security, it's complicated, and there are tradeoffs. First, intercepting SMS is not that easy. It's "easy" for someone who knows w

Like everything in computer security, it's complicated, and there are tradeoffs. First, intercepting SMS is not that easy. It's "easy" for someone who knows what they are doing and is willing to expend some resources, but it's not a casual attack that can be mounted by a script kiddie. It's a lot easier to steal your phone number using a social engineering attack. The easiest one to execute is to impersonate you somehow and get your number transferred to a "new" phone. That one got me a few years ago. Very scary. Second, in order to exploit an SMS attack you have to be able to link the number to e.g. a bank account. One mitigation for this is to use different and non-obvious user IDs for critical accounts. Third, despite its weaknesses, SMS 2FA is better than no 2FA at all. Even if breaking SMS is "easy" it's still an additional cost for a prospective hacker. You don't have to outrun the bear. But it is good to be aware that SMS 2FA is weak. It's better than nothing, but for things that are really mission-critical you should seek alternatives.