Is a phishing attack possible with 2FA

Two factor authentication is meant to keep the bad guys out .. but does it?

Take a G-Suite login process for example .. what if:

Google user enters Gmail-username gullible and password 1234 into the bad-guy website

bad-guy uses these credentials to log into Google, gets prompted for text code, and passes this request on to gullible

gullible enters text code onto bad-guy website

bad-guy completes Google login and immediately changes account setup to lock out gullible

Any thoughts?