[not2b]

They would just get an email saying that [e-mail] (his phony address) accessed the account immediately after giving their info to [e-mail]. He could even have told them to expect and ignore such an email.

[rootusrootus]

There should be a request for approving the login attempt, and if you say yes, you get a six digit code to enter on the device trying to connect. Then when that succeeds, you get another push notification about it succeeding.

[anaganisk]

And thats what happens on any iOS with 2FA enabled.