Relying solely on your phone number for 2FA leaves you open to SIM-swap fraud, where an attacker ports your number to their device. Authenticator apps avoid SMS-specific risks, but setup secrets and synced accounts need protection, and codes can be phished. Prefer passkeys or FIDO security keys when supported.
“App-based codes avoid SIM-swap risks, but they can still be phished.”
Sources for this correction, checked October 17, 2026: https://pages.nist.gov/800-63-4/sp800-63b.html