1 article on this topic.
A first-person identity theft account covered by Bruce Schneier shows how one leaked 2FA code handed a scammer control of a victim's email — and from there, everything else.