Exactly. They might give them their Gmail password, the 2fa code, their credit card number and cvc, etc etc.