You need to have the email of the account along with the password. Once you try and sign into the steam account a message will appear on the email asking if it was you trying to sign into the account and then a code following that you'd have to type in. The only other way I can see you bypass it is if you added another page to your phishing attempt and have them fill out there Email info and First and Last Name.