My mum's Gmail account was hacked by magic

Much better title would be: Phishing and Two-Factor authentication