@ocean provided they know your passwords. unless it's using passwordless login, but in that case, it isn't really a second factor.