No, BAD just inserts your email address on GOOD’s login page which sends you the login code, and they lie to prime you into thinking it’s not suspicious that the email came from someone other than BAD.

When you insert the login code on BAD, BAD uses it to finish the login process on GOOD that they started “on your behalf”.