Just read an article on The Register about MFA vulnerabilities that linked to cisa.gov (US cyber security govt agency). Two of four of the vulnerabilities of MFA relate to the use of SMS as the MFA. The article on the CISA site states; "CYBER THREATS TO MFA Cyber threat actors have used multiple methods to gain access to MFA credentials: • Phishing. Phishing is a form of social engineering in which cyber threat actors use email or malicious websites to solicit information. For example, in a widely used phishing technique, a threat actor sends an email to a target that convinces the user to visit a threat actor-controlled website that mimics a company’s legitimate login portal. The user submits their username, password, as well as the 6-digit code from their mobile phone’s authenticator app. • Push bombing (also known as push fatigue). Cyber threat actors bombard a user with push notifications until they press the “Accept” button, thereby granting threat actor access to the network. • Exploitation of SS7 protocol vulnerabilities. Cyber threat actors exploit SS7 protocol vulnerabilities in communications infrastructure to obtain MFA codes sent via text message (SMS) or voice to a phone. • SIM Swap. SIM Swap is a form of social engineering in which cyber threat actors convince cellular carriers to transfer control of the user’s phone number to a threat actor-controlled SIM card, which allows the threat actor to gain control over the user’s phone" ... View more

SMS is highly insecure. I posted links to articles about this but TPG took my posts down, possibly because they had links to dangerous sites like Wikipedia. If you want some facts on this, Google "SMS insecure" and read some of the articles you find. Also, Google "ss7 insecure". SMS is built on the SS7 protocol and Wikipedia among many others have a whole section on security issues with SS7 - Google "SS7 Wikipedia" and scroll down the page. You could also Google "IMSI catcher" to see how secure mobile call protocols in general are, and it's not happy news. Now, 2FA/MFA via SMS is more secure than no MFA. I think I read that Google initially had a drop in hacks by 30% by requiring SMS MFA. The thing is, the fact that you secure something now with something that is inherently insecure means that you are only giving yourself a false sense of security, which in my opinion is far worse than no MFA. That's why Google (and Amazon, and many others like BitWarden, PayPal, Steam) now send messages to your emails and phones (through the Google app) to ask of it was really you who did that new login *even after* you used MFA. So that is actually at least 3 Factor Authentication in that case. Apps like Authy, which uses the same algorithm as Google Authenticator and Microsoft Authenticator but is more flexible in my opinion, are much more secure than SMS. One of the main reasons Authy is better than the Google and Microsoft authenticator is that it can be logged into from your phone or desktop or tablet, so in the event you lose your phone you won't be locked out because you will still have access to your MFA codes. In my opinion, everyone should be using one of these authenticator apps for every service you use that poses even the slightest risk of giving away personal information, let along being logged into by a hacker. I use Authy for Paypal, Microsoft, and about 20 other services. You should also use a secure password manager like the free and excellent BitWarden, which has apps and plugins for numerous operating systems and browsers. Don't use your Browser's built in password storage for anything that is remotely important as they are not as secure. Also, *never* store your bank password in *any* password manager. ... View more

Also, Google "ss7 insecure". SMS is built on the SS7 protocol and Wikipedia among many others have a whole section on security issues with SS7 - Google "SS7 Wikipedia" and scroll down the page. You could also Google "IMSI catcher" to see how secure mobile call protocols in general are, and it's not happy news. ... View more

Maybe my previous posts got taken down because they included links to articles that described why SMS is highly insecure, but just Google "SMS insecure" and read the articles you find. ... View more

The concern is that MFA or 2FA is not practical via SMS on mobile phones when out of range, including being overseas, and also that SMS is highly insecure. ... View more

I put up other replies to this that were taken down by TPG. Can only imagine why? ... View more

You could use a Two Factor Authentication app on your computer, if TPG decided to support this method, which is actually far more secure than SMS and works overseas. One such app is called Authy and works on Windows, Mac, Linux, as well as iPhone/iPad and Android if you have a tablet. See https://authy.com/ See also https://community.tpg.com.au/t5/TPG-Community-Feedback/Multi-Factor-Authentication-options/m-p/118367 where there has been some discussion around this issue. ... View more

My suggestion of using 2FA apps would solve this problem and be more secure than SMS and email. https://community.tpg.com.au/t5/TPG-Community-Feedback/Multi-Factor-Authentication-options/m-p/118367 ... View more