Comment by msh

Or just Google authenticator without a phone number. You can still be phished but it's better than sms.