For a really sophisticated attacker, even 2-factor authentication isn't secure from this. They can ask you for the 2-factor authentication code the same way Go

For a really sophisticated attacker, even 2-factor authentication isn't secure from this. They can ask you for the 2-factor authentication code the same way Google does. You would type it into the phishing site.