Here are some ways to access your messages, trace your calls and location which are used by Law-enforcement Agency but not accessible for Common Peoples which I know/heard/read on Google.
So, I will be writing the ways in increasing order of Difficulty.
Brute Force Attack – It is the form of attack where an attacker tries all possible combinations of the key one after the other in quick succession.

This is First Approach which we generally used to crack anyone password. But, this will not work here because OTP generally is of 4-6 digits. If we apply “Permutation/Combination and Probability” here.
Then there are around 10000(=10101010) combinations for 4 digit OTP and 1000000(=101010101010) combinations for 6 digit OTP
Out of these many combinations, only 1 is correct. So the probability of guessing a correct OTP is 1 in 10000 and 1 in 1000000 for 4-digit and 6-digit OTP. The Person has to be very lucky!

If it's a six-digit password and you get three tries to enter it, then three in every 10,00,000 attacks will succeed by trying random passwords.
A Man-in-the-middle (MITM) attack – A form of attack in which the attacker intercepts the communication between two-parties, fools them to believe that they are communicating with each other, whereas they actually communicate with the attacker.

Android App: An app on the phone leaked the information using permissions. On Android when you install an application it will popup a message with all the access the app requires. Apps offering a minor functionality sometimes request to access email, SMS, contacts, photos, location, and browsing history - way more than required to do what they say. If you permit an application access to SMS messages it will be able to legitimately forward every SMS you send or receive to a third party.

Malware: If phone is hacked - phone malware could have given the phishers access to text messages on phone

SIM Cloning: If the phone is a GSM then it's possible to clone SIM and receive OTP message.
SMS-C’s Server: Text messages are processed by systems called SMS-Cs - servers running software that handles text messages which are located in the cell provider's network. If the phishers managed to hack the SMS-C they could have access to every text message in the system.
