Well, it’s secure to a certain point anyway. Without going into a detailed security discussion (which I’m not qualified to do anyway. I know something about the topic, but I’m not an expert!), there are arguments on both sides on whether it is secure or not. Or rather how secure it is.
Both sides agree that it is possible to hack two factor authentication when the passcodes are delivered via SMS. It takes certain hardware (which is readily available to those who know what to get), and while the network itself provides some encoding there are ways around that too.
But the truth is that those approaches to hacking the passcode aren’t that practical in most circumstances. Stackexchange.com is a technology website where people can ask questions and get the technical answers they need. Someone asked if two-factor authentication using SMS is secure. You can read the whole thread, but here is a quote summarising the discussion:
Also, in summary, it seems that SMS is a reasonably secure means of transmitting short-lived secrets, e.g. for two factor authentication. An attacker must know your (phone’s) physical location, know when you’re likely to receive a secret, possess and know how to use what is most-likely pretty expensive radio equipment, and have completed a fairly involved project to run “a truly massive computation” (correctly). Attacks would almost certainly be made only against very high value targets.
All these concerns are directed at someone being able to intercept the passcode, which is usually only valid for a short time after sending. But in order for the passcodes to be of use, the attacker would also have to have the first part of the authentication too – your user name and password for whatever service you’re using.
There have been reports of new hacking strategies that trick users into installing or downloading software onto a computer to capture this data. That software captures keystrokes to get your email and passwords, then provides a fake popup requesting you provide your phone number. Somehow then, the software (or the hacker behind the software) can now see both sides of the two factor authentication and the entire system is compromised for that user. This scenario though, points out the need to raise awareness of users so they don’t become victims to these types of deceptive tricks that hackers use to gain control of computers.
It’s really a much bigger issue than just what I’m addressing here, so for the sake of argument let’s assume no one falls for these hacker tricks. Then using SMS for two factor authentication can be considered secure for practical purposes (also assuming the SMS messages aren’t being forwarded back to your computer via email which then negates the point of the “two” in two factor authentication).