[Thorrez]

It does depend on whether the hardware 2FA is U2F (which stops phishing) or OTP[1] (which doesn't).

[1] http://www.tokenguard.com/RSA-SecurID-SID700.asp