Google's BulletProof Two-Factor Authentication Could Be Bypassed Using Cell Phones.

Looks like two factor authentication at Google (or any other  organization) is not what it seem to be. Some bad people have been able to hack an Instagram account by bypassing two factor authentication used by Google, GMail.
Just like bulletproof vest might not save your life, two factor authentication can make it only more difficult to hack.
In this case a cell phone company was at the fault, allowing a phone number to be forwarded without proper authentication.
Geemodo: Google's BulletProof Two-Factor Authentication Bypassed To Hack Into An Instagram Account.