My bank now sends alerts and verification codes via SMS. SMS should be assumed to be completely compromised given that it runs over SS7. 2FA using SMS is worse than an uncompromised password. I am disappointed that more and more banks and websites forcibly allow password recovery using nothing but SMS, but it seems like I'm just tilting at windmills.