Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS.
Firstly, are these messages any safer than classical SMS (like the one you send to your girlfriend, asking whether to buy bread) ?
Secondly, how are these messages sent ? Could it be done without using Twilio, or other SMS gateways ?
It's not actual 2FA but 2-step authentication. As linked by StackzOfZtuff they are in fact plain SMS messages.
The reason it's two step and not two factor is because two-factor would imply you need true possession of the object where the token is generated and there has to be assurance the token cannot be intercepted by another party. This is where SMS is flawed. SMS has a few known vulnerabilities which would technically make it possible for interception:
That said the messages are indeed sent using SMS gateways. So is it in fact fool proof way of authentication? Probably not. However each bank does a risk assessment on what the likelihood is of attackers performing the above attacks with the purpose of stealing bank accounts and probably realized the likelihood would be low. It would require a lot of effort in case of SIM cloning or false base station attacks versus the return on investment. If someone manages to compromise a complete cellphone carrier, then there would probably be more valuable attacks to perform than targetting individual bank customers.
Furthermore most banks often require additional confirmation mechanisms to perform actual transactions (but this depends on the bank of course). For instance my bank will not allow me to send transactions to accounts to which I have not sent money before. Otherwise I need to sign the transaction with a card reader.
