Although I agree that 2FA like Google Auth/Authy/etc. doesn't authentify the site, I'd like to comment on this: > Then the fake site uses your real token and l

Although I agree that 2FA like Google Auth/Authy/etc. doesn't authentify the site, I'd like to comment on this: > Then the fake site uses your real token and logs in as you. > > Game Over. Depending on how the site's security work, it's not totally game over. I've seen sites, optionally (you still have to turn the feature on), requiring a 72 hours delay before any setup change is taken into account (like, say, a password change). During this time a warning is sent by email and you can at any time during these 72 hours, unilaterally, prevent the change from happening. So it may be "game over" in that the attacker can login and see all you account/activity/data (which, yes, is really bad) but it's not totally "game over" as in it doesn't mean "logged out of your account" (unless the attacker also compromised your email ofc, but now we're talking about something else).