Based on the AJ Styles SIM-swap incident, here’s recent, authentic advice you can act on today:
The hard truth about SMS 2FA in 2026:
SMS 2FA isn’t security. It’s a liability. Hackers don’t need your password - they just need to convince your mobile carrier to move your number to their SIM. Once that happens, every code sent by text is theirs. AJ Styles had 2FA on and still lost his X account to racist tweets crypto scams. This isn’t rare, it’s a broken system that depends on the weakest carrier employee.
Do this instead, right now:
1. Ditch SMS 2FA on high-value accounts - crypto, email, banking, social media. Switch to an app-based authenticator like Google Authenticator or Authy. Codes stay on your device, not in your text messages.
2. Upgrade to a physical security key - YubiKey is the gold standard. Even if hackers have your password phone number, they can’t log in without the physical key. It’s the only 2FA hackers can’t phish or SIM-swap.
3. Assume your number will be targeted - Add a PIN/passcode with your mobile carrier. AT&T, MTN, Glo, Airtel all offer “SIM lock” or “port-out PIN”. It won’t stop all SIM swaps, but it adds friction.
4. Audit where your phone number is the recovery method - Go to Gmail, X, bank apps, crypto exchanges. Remove your number as the backup if possible. Use backup codes authenticator apps instead.
Bottom line: If your security relies on SMS, you’re defending with a paper shield. Switch to app-based or hardware keys today. Your future self will thank you.