A phone number is a route, not a secret
A text message reaches you because a mobile carrier associates your number with a particular SIM or eSIM. If a criminal persuades the carrier to transfer that number to a SIM they control, future messages—including login codes—may arrive on the criminal’s phone instead. This is often called a SIM swap. The attacker does not need to break the account’s encryption; they exploit the carrier’s process for deciding which device receives the number.
There is a second weak point: the person holding the phone. A convincing fake sign-in page, support call, or message can prompt someone to type a fresh code into the wrong place. Because the code is meant to be used immediately, a scammer may be able to pass it along to the real login while it is still valid.
What stronger second factors change
An authenticator app typically creates short-lived codes on the device instead of sending them through the carrier’s text-message system. That removes number transfer as a way to receive the code, though a user can still be tricked into entering it on a fraudulent site.
A security key changes the exchange more fundamentally. When used with a compatible sign-in system, it responds to the real website rather than simply supplying a code that can be copied elsewhere. That makes ordinary lookalike-site phishing much harder: the key’s response is tied to the site it is registered with.
Text codes can still block someone who has only stolen a password, so they are better than no second check. But the method matters: a code delivered to a phone number depends on both the account system and the carrier’s control of that number. For important accounts, a stronger factor reduces the number of people and systems an attacker can target.
