There are OTP algorithms that allow both parties to identify each other (not just one way where the server confirms the identity of the client), so you can't be subject to a MITM attack.

In EU, 2FA is mandatory, but it's really frustrating that the law allows to use SMS codes as a second factor. The typical hack in my country is to use a rogue employee in a phone shop to clone a SIM card, and then you are screwed up.