I have one of those 2FA code generators, and used to have a different one with a business account, too.

In both cases the authorisation challenge/response involves part of the destination account number, so if the details are tampered with by malware the code won't work.