Apple 2FA

ab406 wrote:

I’ve always felt good that Apple uses 2FA, but I’ve come to realize that this, too, is based on your phone number, and not the device. Please tell me I’m wrong?

With 2FA, your Apple ID account can only be accessed on devices you trust. To sign in to a new device, you will need to provide your password and a six-digit verification code that would automatically be displayed on your trusted devices.

2FA requires two things:

1. A trusted device - A trusted device would be an iPhone, iPad, iPod touch with iOS 9+, or a Mac running OS X El Capitan or later that has already been signed into two-factor authentication.
2. A trusted phone number - A trusted phone number is a number that can be used to receive verification codes by text or phone call. You must verify at least one trusted phone number to enroll in two-factor authentication.

However, 2FA does NOT require an iPhone to either set up or use it. You can have verification codes sent to any trusted phone number -- those can be Android or other non-Apple phones and even to landlines.

For the iPhone, a SIM card only contains data from your cellular provider. It does not contain anything related to your Apple ID.

Regardless, if you believe that your Apple ID is compromised, I suggest that you review the following support article:

• If you think your Apple ID has been compromised - Apple Support