Stop waiting for a "security alert" email to take action. Go to your security settings today and turn on the second step.
SMS as the only recovery method for your authenticator app. That creates a circular dependency. 2sv account protections