Tell HN: PayPal uses SMS 2FA which is unsecure

So I recently setup a Paypal account and was shocked when I went to login and it required SMS 2FA to verify my identity. I mean, I own a Yubikey, and there's no option to use a Yubikey U2F token to login, strictly SMS only.

Over recent years I've heard horror story after horror story about people getting their number compromised or getting their number into the wrong hands, or getting their SMS OTP codes intercepted, because SMS is unsecure and I regard it as essentially plaintext that can be read by any malicious actor.

I use Paypal since many sites have it integrated and you can cancel subscriptions to avoid unexpected charges on your card. Plus they're a good middleman incase you need to settle disputes, scams etc. Also I'm a freelancer and many clients use Paypal for money transfer since they don't know of any other way to move funds from A to B, so I'm kind of forced to use it.

But I'm so worried about their unsecure and outdated SMS 2FA approach when we have industry standard things like Yubikeys.

This post is just a heads up: if you're using Paypal, you are potentially exposed and unsecure.