Comment by klodolph

Dedicated attackers routinely bypass two-factor auth. If your second factor is your phone, then they simply attack via the phone carrier first.