> 2FA absolutely will protect you from a phishing site using the password it stole.

That's assuming one used a different password for the email or mobile provider.