They'd have to know your password, and get you to click your 2FA accept button, that's 2 factors still