If you're asking that question you're probably already at lower risk. Just think of scammers calling up your grandparents or something like that; they pretend to be Microsoft, ask for the user's credentials, attempt to sign in, then ask for the user's one time passcode. You can get more elaborate setups but that's the gist.