Two-factor authentication dramatically improves account security — but it doesn't make you immune to phishing. The answer depends on which type of 2FA you use and how sophisticated the attack is.
In This Guide
What Standard 2FA Protects Against
Most account takeovers happen because of leaked passwords — from data breaches, credential stuffing, or password reuse. In these cases, 2FA is highly effective. Even if an attacker has your correct password, they still can't log in without your second factor. This is why enabling any form of 2FA is far better than having none.
Real-Time Phishing: The Attack 2FA Doesn't Stop
Adversary-in-the-middle (AiTM) phishing uses a proxy server that sits between you and the real site. You think you're logging into the real website, but you're actually logging into the attacker's server, which forwards your credentials and 2FA code to the real site in real time.
Here's how it works: you receive a convincing phishing email, click the link, and land on a fake login page that looks identical to the real one. You enter your username, password, and 2FA code. The attacker's server immediately uses all three on the real site and creates a session, then gives you an error or redirect to cover their tracks.
Tools like Evilginx2 make this attack trivially easy to execute. It's increasingly common against high-value targets — executives, crypto holders, and people with access to valuable systems.
SMS 2FA and Phishing
SMS codes are the most vulnerable to real-time phishing because they expire in a few minutes, giving the attacker plenty of time to use them. They're also vulnerable to SIM swapping as a separate attack vector. SMS 2FA is better than nothing but provides the weakest protection of any 2FA method.
TOTP Authenticator Apps and Phishing
TOTP codes (from apps like Google Authenticator or Authy) expire in 30 seconds. This makes them harder to use in real-time phishing — the attack has to be automated and instant. However, sophisticated AiTM attacks do handle this. TOTP is much better than SMS but is not phishing-resistant in the strict technical sense.
The Only Truly Phishing-Resistant 2FA
Hardware security keys using the FIDO2/WebAuthn standard are the only truly phishing-resistant 2FA method. Here's why: the key cryptographically binds its response to the exact domain of the site you're authenticating with. If you're on a phishing site at fake-google.com instead of google.com, the key detects the mismatch and refuses to authenticate — even if the page looks identical.
This is why security researchers, government agencies, and high-value targets are increasingly using hardware keys. Google reported that after requiring all employees to use hardware keys, account takeovers dropped to zero. Passkeys, the newer standard built into phones and operating systems, work on the same principle.
How to Protect Yourself
Enable 2FA on every account that supports it — any 2FA is far better than none. Be sceptical of unexpected login prompts, emails asking you to verify your account, and any site that asks for your 2FA code outside of the normal login flow. Legitimate services will never ask for your secret key or backup codes.
For your most important accounts — email, crypto, work systems — consider a hardware key or passkey if supported. Check whether you're using the right 2FA method for each account's risk level.
You can verify your TOTP codes are working correctly using a browser-based 2FA generator without your codes ever leaving your device.
Real-World Attacks That Bypassed 2FA
Real-time phishing is not theoretical. In 2022, Microsoft reported detecting adversary-in-the-middle phishing campaigns that targeted more than 10,000 organizations, with attackers relaying 2FA codes through proxy pages to take over cloud accounts. The same technique has been used against banking customers, crypto exchange users, and corporate email. In these attacks, victims did everything right as far as they could see: they entered their real password and their real 2FA code on what looked like the legitimate login page.
Even attacks that do not use fake pages can defeat weak 2FA. The high-profile Uber breach in 2022 involved an attacker who obtained an employee's password and then sent repeated login push notifications until the employee accepted one — a technique known as MFA fatigue. It is another reminder that the second factor is only as strong as the weakest prompt, and that unusual prompts should be treated as suspicious even when they come from a real service.
How to Spot a Page That Is Trying to Steal Your Code
Check the address bar before entering anything. Look at the exact domain — a page at myaccount-google.com or google.com.verify-login.net is never legitimate, no matter how identical it looks to the real thing. Bookmark the login pages you use often and navigate to them from the bookmark rather than from links in emails. If an email asks you to "confirm your account" and then requests your 2FA code, that is a strong warning sign: the code belongs in your authenticator app flow, not in a web form you were sent to.
Finally, trust the feeling that something is off. An unexpected code request, a login prompt outside the normal flow, or a page that asks for backup codes or your secret key are all red flags. Legitimate services never ask for your TOTP secret or backup codes, and a genuine login only happens when you initiate it.
The Phishing-Resistance Ladder
It helps to think of 2FA methods as rungs on a ladder. At the bottom is SMS: codes arrive over the phone network, where they can be intercepted or relayed, and the account can be taken over through SIM swapping without any phishing at all. Above that sit TOTP authenticator apps, which defeat SIM swapping and casual credential theft but can still be relayed by a real-time phishing proxy. Above those are push-approval prompts (like "Did you just try to log in?"), which raise the bar but can be defeated by prompt fatigue — the attacker spamming approvals until you accept one.
At the top are hardware keys and passkeys, which bind the authentication to the exact domain. Each rung adds protection against a narrower set of attacks, so the goal is to climb as high as the account's value justifies — SMS for a low-value gaming account, an authenticator app for most things, and a key or passkey for email, crypto and work systems.
One more note on the middle of the ladder: push prompts are convenient because there is no code to type, but the prompt itself is the attack surface. If you use push-based 2FA, never approve a login you did not start — attackers rely on people reflexively tapping "yes" on a notification that looks like it came from a service they use daily, and one tap is all the session takeover needs.
Passkeys: Phishing-Resistant 2FA Built Into Your Phone
Passkeys are the modern successor to hardware keys, and they bring the same domain binding to devices you already own. When a site supports passkeys, your phone or laptop stores a private key in its secure hardware and presents it only to the exact site it was created for — a fake login page at a lookalike domain gets nothing, because the passkey checks the address before it responds.
This matters because passkeys are now the default on major platforms: Google prompts you to create one, Apple signs you in with iCloud Keychain, and Windows Hello does the same on Windows 11. If you have been treating 2FA as "type the six-digit code", try the passkey option next time a supported site offers it — you skip the code entirely and gain phishing resistance at the same time.
Practical Habits That Close the Gaps TOTP Leaves Open
- Navigate to login pages from a bookmark or by typing the domain yourself; do not click through from emails
- Look at the whole domain before entering anything — the component just before the final suffix is the part you must verify
- Never enter your code on a page that also asked you to "confirm your recovery codes" or your "setup key" — those belong to setup screens, not logins
- Use a different password per site so a leaked password never combines with a phished code from elsewhere
- Treat any unexpected 2FA prompt as an incident: if you did not start a login, someone else is trying to
None of these habits requires special hardware, and together they close most of the realistic gaps in TOTP. The one remaining gap — a live phishing proxy relaying your code within its 30-second validity window — is precisely the one that a hardware key or passkey eliminates, which is why high-value accounts should pair these habits with a stronger factor.