Most popular forms of two-factor are still phishable. WebAuthn/passkeys are a better solution.