All terms
An attacker takes over your phone number to defeat SMS two factor authentication.
The attacker convinces your carrier to port your number to their SIM. Every SMS code then goes to them, including exchange login and withdrawal codes.
This is why SMS is the weakest form of two factor authentication, and why it should never protect an exchange account holding real money.
Use an authenticator app or a hardware security key instead of SMS wherever the option exists.
Where to go next
More security terms
Want this explained out loud?
Some of these land faster in conversation than in writing. Sessions are one to one and you can ask anything, including the things that feel too obvious to ask.