Can you turn two step authentication off??

I was wondering if anyone could explain to me in “layman’s terms” because I am not very tech savvy..

If someone has 2 step verification on, how can someone hack into your account? I understand how it works to some degree, they are intercepting the code to authenticate their own devices as well, but HOW are they doing it!? Even if they have your phone number they still somehow had to have verified the number am I correct? Let’s just say, a “friend” has had every account broken into and she thought it was coming through google apps like gmails and such but it’s taken my whole phone hostage. Did a factory reset and it’s still doing it. She’s having all sorts of new emails being attached to her accounts, they are even trying to get into her PayPal account as we speak! Security codes keep popping up when she’s not trying to access it. It seems they’ve planted some type of file or something that’s not able to fully and permanently erased. Please help her!!