Hmm. Makes me wonder about the security of two factor authentication schemes. For scams like these it's pretty obvious that someone is trying to access your account, but I do wonder if there are more secure ways to verify your identity when changing account settings.