security.googleblog.com/2019/05/new-re…
-Google's app-based 2FA (using its verification prompts) was 90% effective against targeted phishing and 99% effective against bulk phishing
-Both forms of 2FA were 100% effective against "automated bot" credential stuffing & spraying attacks