If you're asking that question you're probably already at lower risk. Just think of scammers calling up your grandparents or something like that; they pretend to be Microsoft, ask for the user's credentials, attempt to sign in, then ask for the user's one time passcode. You can get more elaborate setups but that's the gist.

Fairly easily if you create a good replica of the original website the user is trying to log in to.
In a lot of cases, even technically savvy people are not going to verify the URL.

Call them, say you are the bank and they have seen fraudulent transactions, and to restore the account they will send you a code which you have to tell them...

For the sms codes: it's also pretty easy to copy/clone a sim

There is also the option of a MITM attack with a portal that forwards the login to the real login page and then cuts your connection and the MITM has the open session.

The good thing with passkeys is, there is nothing a fraudster can get from a user. You can't forward your passkey via the phone, and MITM are much, much harder to pull off

Evilnginx has existed for almost a decade to get totp codes.