Even after a decade running an email security business, I personally fell for a device code phishing attack from my mom’s accountant with a real Microsoft sign-in page
Indeed. I was going about my normal day, not expecting to hear from my Mom's accountant. I wasn't on "alert." Terrible mistake, as I had to drop everything once I realized what happened.
It's my opinion that acting quickly is the real problem.
Every time something asks for any kind of credentials, stop and consider if this was expected, and if it is proceeding exactly as normal.
Indeed. I was going about my normal day, not expecting to hear from my Mom's accountant. I wasn't on "alert." Terrible mistake, as I had to drop everything once I realized what happened.