The SMS interception via social engineering of telecom support staff, as others have pointed out, seems most likely, but consider another approach: an app on the users phone with message read permissions. Most people are not diligent enough to perform an audit of the permissions requested by every app they install and I could also believe a determined attacker might install an app on an unattended and unlocked phone given the opportunity.

I once walked into a T-mobile store, showed them my phone and claimed that the simcard is stuck and asked them to transfer it to a new simcard I brought with me. They asked for my phone number, scanned the barcode on the new simcard, done. I didn't have to provide any identity. I could have been anybody and the only trace would be the security camera in the store.

People are saying social engineering the legitimate operator, but my off-net SMS provider doesn't require any validation from the original operator. I've successfully "stolen" the SMSs from my cellphone with no validation that I was authorized to do that, never heard about it from my carrier (T-Mobile).

By taking control of your phone number or the radio network your phone connects to, or attacking the signaling network itself, to intercept information going to your phone number.

Basically, imagine every conceivable way any human or computer might at any point interact with a plaintext signaling packet designed to be passed around the world by different companies and eventually read by people. Now attack all of them. Something somewhere will give it up.

Depends on the attacker and target. Many of the cell towers are insecure. Even today the SS7 attack works on many of them, and phones continue to blindly trust insecure cell towers. For a tech-central place like SV, you get a pretty good return on some risky cell tower setups. Unfortunately most developers don't utilize multiple phone numbers, so a mapping between email and phone number is frequently in some semi-public database.

Of course if you have a 0day RCE its possible to get the SMS as well. Even local malware on the computer that you're entering the code into could work if you're an identified target. Many protocol downgrade attacks are possible too, though I'd wager most developers would notice the lack of HTTPS in the browser bar.

And of course social engineering the cell phone company. Though if you call you can put a flag on your account to make it harder to transfer numbers.

Essentially, convincing a mobile operator to transfer someone’s phone account to a SIM card an attacker controls.

Take a look at this post for an example attack

https://theantisocialengineer.com/2018/07/23/sim-swap-fraud-...

This is definitely more an edge case (and not really an intercept), but if the user has an iPhone with SMS forwarding set up (via iMessages), the "intercept" could occur by accessing the users iMessage account and waiting for the forwarded SMS to arrive.