Isn't TOTP also prone to phishing? If I can present a form to someone and trick them into entering their credentials, why not present a second form that also re

Isn't TOTP also prone to phishing? If I can present a form to someone and trick them into entering their credentials, why not present a second form that also requests the TOTP code? That gives me a window of opportunity to log in as the user, or just script that part of it to happen automatically. Would that not work?