Why shouldnt you use SMS for two-factor authentication and what are the alternatives?

Security experts always recommend using two-factor authentication to secure users' online accounts. Many services default to SMS authentication, but is this really a safe option?