The OTP code you were told to read out
The message arrives from the right number, because they caused it to be sent. Why the request itself is the answer, and the one method that cannot be spoken aloud.
Tag
#Passkeys
Your recovery options are the real password
Account takeovers rarely start with a guessed password. They start with a recovery email or phone number nobody had checked in years — and the change is designed not to be noticed.
SMS codes, authenticator apps, passkeys: which actually stops account takeover
All three are called two-factor authentication and they are not equivalent. Two of them can be phished in real time; one cannot, for a structural reason worth understanding.