Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
You don't say what kind of 2FA process you are using and which kind of phone you have. But if the hacker manages to install a privileged application to your phone he might be able to capture 2FA tokens send with SMS or extracts the secrets from some OTP apps you use.
The difficulty of bypassing 2FA depends on the mechanism used for the second factor, but with SMS codes it's definitely possible and has been done before. In an actual incident recently, hackers were able to trick Verizon employees into redirecting the texts to a different phone by simply impersonating the subscriber.
The short answer is yes.
They could install malware onto your phone, add an SMS redirect, hack a phone service, or just hack the target site.
In case of codes sent with SMS or email, in addition to an already mentioned maliciuos app being planted on a device:
recently a social engineering hack has been revealed where an attacker sends a message convincing the victim to forward (or input on attacker site) the legitimate authentication message (login attempt from the attacker) that will follow
you can subvert the security yourself by running apps like Google Hangouts (configured to handle SMS) or Pushbullet which forward the message or just the contents of screen notifications to other devices that might not be in your vicinity, but might automatically display the contents (like a tablet left at your office)
Yes. I speak from experience. Our company account has been hacked while we had 2FA in place.
- Service provider: Amazon AWS
- The technique: social engineering.
The hacker convinced the AWS servicedesk to disable 2FA.
The other answers here all talk about hacking your phone, or the website. This "hack" is another route and very effective.
If the hacker can somehow take over your email, that's another way. Many 2FA mechanisms have a reset or failback via email. If they control your mail, they can reset anything that can be reset via mail.