>If you get a message indicating the 6-digit code you entered is invalid, that should be a lot more concerning to you I could type the 6-digit code incorrectly

>If you get a message indicating the 6-digit code you entered is invalid, that should be a lot more concerning to you I could type the 6-digit code incorrectly just as well as I could type the password incorrectly. Additionally, some sites might check both the password and the 2FA code simultaneously as a security mechanism to prevent attackers learning if the password is correct. Additionally, the phishing page could simply redirect the user to the real site. The user is likely already logged in to the real site, so it will appear to the user as if the user just performed a successful login. If the user isn't logged in, it will seem like some type of site glitch, and I've experienced glitches like that myself.