-
2FA systems that send via SMS
You should have stopped there.
My daughter's WhatsApp account was taken over 2 weeks ago. She couldn't receive the SMS messages to recover it until she had rebooted her phone. I can't prove it but it seems like someone had diverted SMSs to her with an SS7 hack. I thought that was hard enough that you had to be high value target but apparently not anymore.
If you haven't already turn on two step verification within WhatsApp (settings, account).
Security systems that email a code that expires more quickly than Gmail can reliably pull it from my domain's mail server.