TOT Google email re BT mail

and hopefully it still does have a different password. Using the same one on more than one account/site is really a bad idea these days (to be fair it was never good!)

Yup they last set of results I saw for this showed that many did resist attempts, but a significant minority would still port a number without adequate verification. Also, as you allude to, it does depend on how much data gathering the attacker has done on the target.

That is one of the points of the app based approach - there is no "arriving" to happen. The app generates codes continuously in real time. You simply type the currently displayed one into the site when requested. It works irrespective of any phone service or SMS capability.

You can use multiple authenticator apps as a backup to text messages.

(thanks, I'm now checking all 2FA accounts for backup authentication methods, not linked to phone numbers or email accounts)

However, with all the scams about it's probably worth closing PayPal and using a credit card instead. Paypal typically sets up a direct link to ya bank account, and allows limitless funds transfer.

If someone else is not completely conversant with the security procedures in using such a thing, I'd venture that very service alone is a very dangerous thing to have hiding behind just a password.

My PayPal account is linked to my credit card, which is probably much worse. I do check it every month, though, and it hasn't shown any spurious payments. I don't know how good PayPal would be at sorting out any problems, or whether my CC company would help.

In general I think that modern financial security is much worse than the days of cheques and signatures. There are just so many ways that it can go wrong.