It’s kind of nuts, with one of those SS7 tickets you could easily use a bot to drain 1000s of bank accounts an hour based on the 2FA vulnerabilities.
Banks usually have information they can ask like Social Secuirty Number (which is inevitably in some leak).
eBay is the first one that comes to mind. I know I've run into it a couple of other times where a website will just offer to text you a code, but usually there is a small link you can click that says "use my password instead".
Facebook and Amazon don't have my cell phone number, but I bet they have an option.
I don't usually try to reset my passwords since I use a password manager, so it's probably more common than that.