There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.