2FA can actually prevent phishing, though it requires close integration with the app and the authenticator. It's actually quite similar to CSRF prevention. On t

2FA can actually prevent phishing, though it requires close integration with the app and the authenticator. It's actually quite similar to CSRF prevention. On the site itself, display a random nonce to the user for confirmation then send an request for authentication to the authenticator with said nonce which the user can confirm. The battle.net authenticator does this. For added protection, you can prompt the user to select which nonce is correct to force them to verify it is correct. The Microsoft authenticator does this sometimes. The downside of this approach is that it requires a constant connection between the second factor the service. It also relies on the fact that the service authenticates itself via TLS or some other means, though that is a relatively minor issue.