new password every two months

Umm, no.

1. Generate non-idiotic, unique password with letters(caps+small)+numbers+symbols+diacritic-letters if it will allow you
2. Use credible password manager to store.
3. Turn off text message display when phone is locked, only when unlocked.
4. Don’t be a dumbass + use TouchID/FaceID for app login or only use in Safari with autofill from password manager.

I have no idea still how this happened