Two-Factor and Two-Step Authentication

Some guys are doing phishing sites (steam for example) which requests an authorization code. After you enter it your account goes to them automatically. I don`t know how they do that but it`s true.