This is why Passkeys are getting pushed right now. They make it physically impossible to sign in to a phishing site.