2FA is a MUST but combining 2FA with Awareness training is the way-to-go - Hackers have been refining their password-stealing schemes to also nab the one-time passcode. So-called "phishing kits" steal a victim's password and two-factor authentication passcode as they type it into deceptive email and login pages, and then quickly break into the affected account within the 30-SECOND time limit.

OR
Use hardware-based solution like USB security keys (which introduce a different problem, support and maintenance)

https://in.pcmag.com/google-titan-security-key-bundle/129100/google-phishing-attacks-that-can-beat-two-factor-are-on-the