I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the passwords in almost all the accounts (like gmail, outlook) etc and hijack everything.
This also defeats 2FA (at least in Google) as anybody who controls my phone number can reset the password of gmail. Once an attacker has access to Google account, they can go on to gain access to almost every other website where my gmail account is the verification mail. This includes AWS or Google cloud where I could then be charged significant amounts of money.
So my first question is how do I prevent this from happening? Is there any way to tell Google to stop using my phone number as fallback for verification or tell them to use something else along with phone number.
2nd question. If this happens, how can I recover my accounts (Google and all the connected accounts) as soon as possible? This will be difficult because the attacker will probably change all my passwords. He/she might also go one step ahead to change the verification emails/phone number, effectively locking me out of my account. Also if I somehow, do manage to gain back the access to gmail, the attacker could meanwhile hijack all my other accounts tied up with gmail and change email id in them preventing me from resetting password there.