I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset.

I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.