This is the biggest problem in cyber security. You can tell someone to NEVER give out their TFA code over the phone and they will still do it when prompted by a phone call from their boss.