You want to be authenticated specifically on the device that you're using to access the website. Not some arbitrary other device.

If you enter your username, password, and totp, and the website tells you you've logged in from some device halfway across the planet you've never heard of, you probably have a problem.