You're told not to share your two-factor or other authentication code. And then you're asked for it.