① Victim enters email → ② Victim enters password → ③ You log in with creds → ④ Type Google's number here → ⑤ Victim taps phone → ⑥ Mark verified