Google found out that almost 100% of automated phishing attacks can be prevented with ANY form of 2FA: https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html