[jandrese]

There is no help desk that can give away your TOTP secret. That’s the big weakness with SMS, someone buys a phone and asks the clerk to give them your phone number.

[UncleMeat]

It is a publicized weakness. In practice, phishing is scalable and social engineering isn’t. And humans are shit at detecting phishing attacks.