Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol
SMS is not a secure 2nd factor.  It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks.  Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.