But how did they MITM the verification code? Was the first two presented to the attacker, and the rest was presented to the email? Or were they able to MITM the whole email/code and just shared the first two to gain trust?
Never trust an incoming call, especially if it's talking about authentication problems you didn't know you had.
Googler, opinions my own (and I'm not an expert in this particular space).
(I know it wouldn't necessarily have stopped this phishing attempt.)
(I have to admit I haven't used the UI in question, and I can't find a screenshot of it on Google Images. Maybe this is a lot safer than I'm imagining.)
Still, remember this is MFA - at least I'm pretty sure you can't have this as the only way to access your account. An attacker typically needs your password plus you to misclick here.