Two factor is a huge step. One of the biggest impacts of phishing is due to credential reuse across sites. The damage that a phishing site (or compromised site)

Two factor is a huge step. One of the biggest impacts of phishing is due to credential reuse across sites. The damage that a phishing site (or compromised site) can do is quite limited if you have two factor auth for your other sites. Also, online phishing attacks are doable but have the disadvantage of the victim being right there and potentially able to notice the intrusion instead of the damage being done at arbitrary points in time later. Are you completely secure against phishing when using 2fa sites? No. And you never will be. But you're significantly safer than you would have been without it.