This is a clear example that this can happen to anyone.

Sorry for what you're going through.

This is why Passkeys are getting pushed right now. They make it physically impossible to sign in to a phishing site.