Not true. The attacker is the only one who actually uses the 2FA. The user never gets logged in.