[putlake]

The phishing site will ask you for your 2FA code and then enter it on the real Google login page.

[fnl]

Hmm, but that gets us back to "stage one": For that to work, you have to ignore your URL-bar...