Phishing your credentials

The password given away.

How it works

A convincing page collects your password and then the code you type, relaying both to the real site in real time. Two factor by code does not stop this; a security key does.

Check the domain before typing anything.
If autofill will not offer the entry, treat that as a warning.

Codes are secrets

No support agent, courier or bank will ever ask you to read out a code. Any request for one is an attack in progress.