Good lord, y'all don't need to be so nasty about it.

Anyway, what Jeeqbit said, but for the future, always check urls coming to you - the scammy ones will end with something not .com, or look like they do but instead of ".com/ffxiv/threads" for the forums, it'll be like ".com.xyz.co/ffxiv". If you know you have an account on the forums and are already logged in but it's showing you aren't, never put in your info.

If you don't already have 2fa, you can get the free security token on the Google Play store or the Apple store. Just make sure to write down your emergency token removal code for if you have to swap phones or whatnot (info on those is here, you can also use Google authenticator and some others listed on their FAQ page for them!) While a 2fa wouldn't have helped in this case sadly, it does stop other attempts to get into your account by bad actors.