Oh actually it’s worse than that. There are online companies that offer online SMS services that can receive messages from real phone numbers by essentially telling your carrier you want text messages forwarded to them. Obviously they usually make you prove that you own the number before requesting forwarding, but there’s ways around that. I’ve known several people who’ve had their online accounts broken in to because someone hijacked their phone number’s SMS in order to perform password resets or bypass 2FA.
You can spoof caller ID but you can’t spoof a number to receive texts to it. Can you imagine?
Oh actually it’s worse than that. There are online companies that offer online SMS services that can receive messages from real phone numbers by essentially telling your carrier you want text messages forwarded to them. Obviously they usually make you prove that you own the number before requesting forwarding, but there’s ways around that. I’ve known several people who’ve had their online accounts broken in to because someone hijacked their phone number’s SMS in order to perform password resets or bypass 2FA.