With WebAuthn, the browser puts the origin into clientDataJSON and the authenticator signs over the RP ID hash, so a credential for example.com simply does not work on examp1e.com, and nothing the user types can be relayed. Passwords, SMS and e-mail codes, TOTP apps and push approvals can all be phished in real time by proxy kits, which is why attackers bypass multi-factor authentication routinely.
NIST SP 800-63B-4 defines phishing resistance and requires a phishing-resistant authenticator option at AAL2 and phishing resistance at AAL3; US federal policy (OMB M-22-09) requires phishing-resistant MFA for staff. Recovery and fallback flows must not quietly reintroduce phishable factors.