Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
Of course you should be located in the same country. But it's a risk nonetheless.
There are various ways to nab an SMS. Some are similar to SIM swap attacks in that they rely on social engineering or human or process fallibility to execute [1] [2], and others can grab messages right right out of the air, so to speak [3] [4]. This is in part because one of the foundational protocols that underlie modern cellular networks was never designed with modern security in mind. It's called SS7, and it's been extensively documented as a concern to the security of cellular based communications [5] [6] [7] [8].
Lot's of references because this is an area that has long fascinated me, and I have many bookmarks. There are also some recent papers on this behind paywalls (e.g., [9]).
In between the lines and lightly touched on in some reporting is a nuanced point that I think plays a larger part - one issue is that overhauling these older foundational technologies isn't just a matter of commercial and standards changes but also moving the goal posts on where lawful interception happens in the stack, how it happens, and the technologies that support that. For example in the U.S., law enforcement agencies can acquire devices that impersonate cellular infrastructure in order to force communications to go through law enforcement controlled equipment (called IMSI catchers). If we were to revamp cellular networks with a view toward security in the way we probably should, it's reasonable that devices like that wouldn't be feasible without being operated by the telephone companies that own the networks, and that would probably become some amount of red tape that law enforcement doesn't like.
[1] https://arstechnica.com/information-technology/2021/03/16-at...
[2] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s...
[3] https://www.firstpoint-mg.com/blog/ss7-attack-guide/
[4] https://www.youtube.com/watch?v=RXBvO8TWGsw
[5] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...
[6] https://arstechnica.com/information-technology/2018/05/nefar...
[7] https://arstechnica.com/features/2019/04/fully-compromised-c...
[8] https://www.zdnet.com/article/5g-networks-could-be-vulnerabl...
[9] https://link.springer.com/article/10.1007/s11235-023-01018-0
edit: formatting
> In SIM cloning attack, the fraudster gains access to the victims physical SIM card and..
Same thing could be done with TOTP.
This is the correct one:
> SIM cloning is the procedure through which a genuine SIM card is reproduced. When the cloning is accomplished, the cloned SIM card’s classifying information is transported onto a separate, secondary SIM card. The secondary card can then be used in a different phone while consuming all the calls and related charges credited to the original SIM card.
https://fraud.net/d/sim-cloning/
There is no need to have physical access.
On the contrary, here is an empirical study demonstrating 100% of the 5 major carriers in US used insecure authentication challenges that can easily be subverted by attackers: