Quite a sneaky attack, but you should never provide your 2FA codes to anyone. https://www.scmagazine.com/news/microsoft-teams-mfa-codes