It depends. SMS is better than nothing as a second factor, but SMS has a weird way of worming its way into single-factor status. I think people should avoid SMS 2FA, and should be skeptical of the security of companies that offer only SMS and neither of TOTP or U2F.

This frustrates me endlessly about Namecheap. They only allow SMS, and, for something as valuable as my domain name (figuratively the keys to my kingdom), that's unacceptable.

Have you tried using a (free) Google Voice number for 2FA purposes? Google Voice has no/minimal customer support, so it should be almost as secure as your Google Account.

Haha, I love the reasoning there. I haven't, but you're right, I should.

Well if you manage to do that, let me know. To my knowledge creating a text/voice compatible Google Voice number is not possible in europe.

I had created one when I was in the US, so I do have one. I can't add a European phone number to it, but I can receive SMS with it.

I transfered my domain to route 53 and let them know this was the reason why.

If SMS can be used for account recovery (ie, 'I forgot my password' functionality) then it is probably worse.

2FA altogether isn't necessarily better than nothing.

At its worst, it opens up a social engineering / customer support "lol lost my phone" attack vector that didn't exist before.

SMS 2FA can be defeated by hijacking someone's number. Happened to me. One day I opened my Macbook and saw the "A new iPhone has been activated for your iCloud account". They had access to my number for hours after I called up my carrier.

Ok, a 2fa protecting anything of value (such as money) should not be trivially breakable by state actors.