2FA works well with the geolocation service SS7 [1,2], so when your text message and OTP code arrives, the firm could also be using SS7 to get your location.

[1] https://en.wikipedia.org/wiki/Signalling_System_No._7

[2] https://web.archive.org/web/20201219144441/https://www.thebu...