I don't see how this can claim to prevent phishing attacks. A fake site can still just steal your username and password as usual, and then go to the real site a

I don't see how this can claim to prevent phishing attacks. A fake site can still just steal your username and password as usual, and then go to the real site and log in with them. Am I missing something? Obviously there is still a benefit to not sending your password to the real site, but their anti-phishing claims seem… phishy.