Can someone bypass 2-step verification?

[rachro]

I received about five emails today, all telling me that someone used my login information to access my Square account. Each login attempt was from a different country. I already had two-step verification enabled, so how could anyone have successfully logged into my account? I reset my password just to be safe, but how could anyone successfully log into my account if I have the two-step verification turned on? Or did they only attempt and didn’t get in?  The email didn’t say.

[VanKalkerFarms]

depending on the email it can also be people sending phishing emails pretending to be Square.  they try to get you to click links in the email to get you to log in with your username and password.  the website will be a near perfect clone of Square.

[rachro]

Thanks. Well, the email address came from @messaging.squareup.com so I thought it looked like an accepted address based on the list of what Square says are their legit email sources.  I am definitely aware of the dangers of phishing emails and how they can be lookalikes to the real thing.

Still, I did not click on any links or reply, which I know better than to do.  The email made it sound like someone actually succeeded in logging in with my username and password and somehow bypassed the 2-step.  I never found out whether that was true.