That's my point. Don't. Use throwaway ones whenever it's not critical information and simply avoid the service should they think secure information should be on the mobile network.

At least that's what I do. But so far things only got worse than better.

Services that use SMS as single only way to reset a password without further verifications are simply not thinking about security enough