My bank took away the ability to do 2FA via email and is phone-only now. At least with the typical Gmail/equivalent account you have the option of making that less vulnerable to social engineering and outright bribes.

I think the popularity of phone numbers is not because it’s a good auth factor but because it is a little more work to Sybil flood with generated identities, compared to say email. So it’s not for our security exactly, but more for the company’s anti-abuse systems, and maybe the marketing department that loves hoarding phone numbers. That it works as a second factor is just a “happy” coincidence.

Which in turn annoys me to no end given that phone numbers are regional. Having no access to banks when moving, let alone traveling, to an area with no cell service or a different country, is infuriating. It’s like “what’s your mother’s maiden name” all over again.

Yet other institutions do single TOTP with SMS backup instead of TOTP with a 2nd TOTP backup.

The former is as bad as SMS.

SMS 2FA is one thing. Bad, but ineffective. SMS-based account recovery is far worse. Every time a major website asks me for a phone number "in case you lose access to your email account" I freak out internally before ensuring I never enter it.