How can 2FA be bypassed if I set a number which is unknown to everybody?

Question

I'm asking about the risks one may face for setting 2FA using their own phone number as second step of a 2FA, in scenarios such as, for example, logging in a bank account page with 2FA that provides only that type of protection. In the latter, if I use a secondary phone number that I don't use and that I keep secret, unknown to anybody, how can I be possibly defrauded in that way, since nobody can leak authentication codes given the secrecy of the previously mentioned number?

P.S obviously I'm just stressing safety concerns, don't think that I'm a potential thief or something.

Answer 1

As long as you use a different secret phone number for each site the risk is probably low since only you and the site know the phone number. But both might leak it anyway: the past has shown that even if a site claims that it uses the phone number only for 2FA it might actually use it for different purposes and might share it with others.

If you have more sites you would need a different phone number for each site though because otherwise the risk of leaking the secret number will greatly increase. Obviously this does not scale since the phone system and the phones are not designed for this.

Answer 2

First off, if the login only uses a code from a text message it is, by definition, not 2FA because that you need two factors (e.g. a code and a password).

In general, text messages neither encrypted nor particularly secure.

Using a separate number will make it more secure, since at least the attacker does not know what they are looking for - and that assumes that you use a separate number for each account. It doesn't make an attack impossible, though. Also you will have to carry a second phone just for that.

I don't know why a bank would allow customers to sign in with just a text message; but if they had any other way of signing in I'd prefer that.