When properly implemented, TOTP codes are difficult to phish without tipping off the user because codes can't be reused. The spec requires that the service not

When properly implemented, TOTP codes are difficult to phish without tipping off the user because codes can't be reused. The spec requires that the service not allow code reuse within a given time window--although not all websites comply with that, unfortunately. Assuming the implementation is correct, that means the phishing page has to convince the user that it's acceptable to enter their TOTP code twice, and they have to log in very quickly. Most (non-spear-) phishing pages are basically just forms that email victims' credentials to the attacker; they aren't capable of logging into someone's account, let alone multiple accounts without tipping off someone on the security team. If you get a message indicating your password was invalid, you're probably not going to pay a whole lot of attention to it--even with a password manager, it's a common message to receive on financial sites. Some go out of their way to impede password managers because they think that's a good security practice. If you get a message indicating the 6-digit code you entered is invalid, that should be a lot more concerning to you, and you should immediately ensure that nobody has logged into your account. If you can hold out for however long the site will accept the code (usually 60 seconds, but some sites have a larger window), you're good. Of course, none of these "ifs" exist with FIDO2 and U2F, which is what everyone should be using instead. If you're in charge of security for a website, please offer FIDO2 and/or U2F.