Aside from "don't link your phone to these accounts" which isn't always possible as many banks in Canada only recently added SMS based 2FA.
Some ideas:
- separate phone for 2FA. This seems quite annoying in practice.
- a daily twilio script that SMS's your number as an indication that you've still got it. Easy to implement, but also easy to ignore and would only indicate after the fact that you lost your account.
It's odd that Canada don't have this?
Also, in Lithuania (and many other countries) 2FA is hardware locked to your SIM card - can't really get new one without showing your Id in a shop (the shop doesn't really use the chip on Id tho).
Same for SIM swapping here in Sweden, they check your ID very superficially
Atleast Scotiabank didn't limit it to 6 characters.
I don't know about Canada but I feel like if you tried to implement this in Australia there'd be a lot of paranoia over a system like BankID with regards to privacy or gatekeeping
I really miss that feature, and wish more online services supported something like it.
Your second scenario is like a dead man's switch. It's interesting, as it could prompt you with a daily challenge that only you can answer. But I don't see how it could be implemented in a normal person's life?
With the second scenario I was just thinking that, if I personally didn't receive the text on a given morning, I would know that my number has been ported and I would begin to freak out and try to race the attacker.
This episode of Reply All involves one of the hosts pissing off a group of SIM swappers, and him trying to go through the process of making himself safe. TL;DR -- It's really hard to do successfully.