[romwell]

Your comment highlights why phone-based 2FA is not a 2FA.

[cube2222]

It is, you need to have the phone.

But if you can access the phone content remotely behind a password, then it stops being 2FA.