You shouldn’t use your phone number for 2-factor authentication — here’s why.