

Not much data is available about the specifics of phishing attempts like this, but the FBI’s Internet Crime Complaint Center received 25,344 reports of phishing in 2017 (PDF). Unlike a stolen password, two-factor authentication software tokens need to be grabbed in real time to be useful. Someone could email you a link to a fake Gmail login page saying your account needs an update, where you then log in with your username, password, and two-factor authentication token. It is still susceptible to advanced phishing attempts. But two-factor authentication isn’t perfect-no security tool is. Two-factor authentication can protect against more-basic phishing attempts, such as when a fake login page tries to steal your password.
