Yes, hackers can use certain phishing messages to work their way around 2FA login processes.