Adding a second factor to an account defeats the most common attack, which is a password reused from a breach elsewhere. It does not defeat every attack, and the gap is worth understanding.
Codes are just another secret to type
A six-digit code from an application or a message is something the user reads and enters. Anything a user can type into the real site can be typed into a fake one.
An attacker running a convincing copy of a login page collects the password and then prompts for the code, exactly as the genuine site would.
Because the code is valid for a short window, the attacker relays it immediately to the real service and the login succeeds while the victim sees an error page.
Relay attacks are automated
This is not painstaking manual work. Toolkits sit between the user and the real service, passing every field through in real time and capturing the resulting session.
Once the session is established, the attacker holds an authenticated session and no longer needs the password or any further codes.
That is why revoking active sessions matters after a suspected compromise, and why a password change alone may not end an intruder's access.
Push prompts have their own weakness
Approval prompts remove typing but introduce fatigue. An attacker with a valid password can trigger repeated prompts until someone approves one to stop the noise.
Number matching, where the user must enter a value shown on the login screen, addresses this by making blind approval impossible.
The improvement comes from requiring information that only exists on the genuine screen, which is the same principle that makes the stronger methods work.
Message-based codes carry an extra risk
Codes sent by text message depend on control of a phone number, and phone numbers can be transferred to a new device through a carrier process.
Where an attacker can convince a carrier to perform that transfer, the codes arrive on their device without any interaction from the account holder.
This makes message-based codes the weakest common option, though still substantially better than a password on its own.
Bound credentials remove the relay
Security keys and passkeys work by proving possession of a private key to a specific site address, and the proof is worthless to any other address.
A fake page cannot obtain anything reusable, because the response is bound to the domain that requested it and the browser enforces the check.
This closes the relay path structurally rather than by asking users to notice a suspicious address, which is why it is the recommended option where a service supports it.