Its too easy to hijack someone's phone number by socially engineering a phone company (ignoring routing/signaling vulnerabilities). A quick search brought up this article:

https://www.theregister.co.uk/2016/12/06/2fa_missed_warning/