Q:

How can an account be accessed even though two-step authentication?

Facebook uses two-step authentication or "login approval", which means that all unrecognized devices will have to enter a code received through SMS. Suppose my Samsung device is the only device that has been logged in to my Facebook account. What must the attacker do so that:

I won't receive any SMS (or at least won't see any)
I don't receive any e-mail about that
The attacker gains access to my account and can view messages/be active (liking, commenting)

What is the most realistic and possible scenario? 

A:

There are different possibilities from the top of my head:

the identifier of a legitimate device has been compromised (by a MITM with a downgrade attack, for example) and used to identify as such device,
the mobile phone has been compromised as a whole (forwarding and hiding/deleting SMS and emails),
SS7-based attack on your mobile number in combination with a compromised email account.

