My question is specifically about Two Factor Authentication and password resets. If an attacker can perform a SIM-swap attack, they only need to know 2 things to reset my password and take over my account: they need to know my Apple ID (which for most people is just an email address), and they need to know one of my "trusted" phone numbers (which for most people is just their own mobile number, or the phone number of one of their close social contacts, such as a spouse). They don't need one of my trusted devices, just control over a SIM card linked to one of the trusted phone numbers on my account. After they swap the trusted phone number to the SIM card under their own control, they initiate a password reset on my AppleID using a web browser and appleid.apple.com. 2FA may be enabled on my account, but because of the SIM-swap, the verification code to the trusted phone number goes to the attacker's device. They enter the code on their device and then change the password on my account to whatever they want. Then, they can log in using the new password they created, and any 2FA code again goes to the attacker's SIM card. At that point, the attacker has complete control over my account.
Again, phone numbers (or the mobile phone carriers) cannot really be trusted. SIM-swap attacks are surprisingly easy and common for attackers to pull off. So how does Two Factor Authentication protect me in this scenario?
