Is MFA ever just for show?

Recently, I had an experience that highlighted a false sense of security I had.

Realizing how long it had been since I checked my credit score, I figured it was time to log into CreditKarma. While logging in, I was prompted to put in my phone number to receive a code, and I did so. While waiting for the code to be texted to me, I noticed an "x" in the top corner of the window, and I clicked it. The window closed, I saw my credit karma dashboard, and I realized that MFA wasn't actually required or even working in the first place - it just looked like it was.

Here are my thoughts/questions:

1) How often is MFA used to provide a false sense of security? 

    If I hadn't clicked the x, I would've put in the code, gotten past the authentication process, and continued my day without a second thought. This time, I did notice. How secure is it, really, to input your phone number for MFA at the same time you receive the code? It would be pretty easy to put in any old phone number for that. I guess it doesn't matter anyway, because I just closed the window and in this case, MFA was just for show.

2) Is this ever used by attackers to harvest credentials?

    This also makes me wonder how you can tell if it is malicious or not. With this kind of display, it would be very easy to harvest confirmed phone numbers, emails, and even usernames and passwords. If I am putting in my own information for multi-factor authentication, there is nothing truly authenticating that I am me. All I am doing is forfeiting my information. It seems pretty ingenious, it is hard to notice because it's easy to put in your phone number without a second thought.

My takeaway:

When it comes to multi-factor authentication, it is only effective using stored info that has already been verified. This allows systems to truly verify that the one logging in is me. If I am asked to put in my own information, or worse, the option to close the window is available, it's okay to be a little suspicious.