> If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot pass

> If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot password on Gmail and it will use your second factor as a way to let you change the password. Most websites use the second factor as a backup, including bank websites.