Which gives you more chance at detecting such an attack. Without 2fa, the funds are already gone.