I still don't get one thing: how could the attacker port OP's number without proving he owns the sim? Where I live (in EU) it's mandatory, isn't it the same in the US?
Here in Italy you must provide your ID card and wait a couple days for the carrier to check the data. Goverment websites even use 2fa as a proof of your physical identity