Common signs include suspicious login traffic from lookalike domains, repeated authentication attempts that appear valid, unusual device or network patterns, and sessions that show credential submission followed by immediate token use. If users report nothing unusual but monitoring reveals unexpected access paths or domain activity, the attack may already be operating inside the authentication flow.
Why the attack is already inside the authentication flow
When man-in-the-middle phishing is succeeding, the most important signal is that the victim’s normal login journey is no longer occurring on a trusted path. The user may still believe they are entering credentials into the bank’s site, but the attacker is relaying the interaction in real time, which means the observable signs often look like a mix of normal authentication and abnormal session behaviour.
That is why the strongest indicators are usually not single failed logins, but patterns that connect credential submission, relay, and immediate reuse. Suspicious traffic to lookalike domains, repeated authentication that still “works,” and sessions that become active almost as soon as the user enters credentials are all consistent with phishing-resistant authentication guidance and a compromised trust path. A bank should treat those patterns as evidence that the attacker is operating between the user and the real service, not merely guessing passwords.
For banking users, the practical question is whether the login event can be correlated with a legitimate device, a legitimate domain, and a legitimate session lifecycle. If the answer is no, the attack has likely moved beyond credential capture into live session interception.
What telemetry tends to separate a bad login from a live relay
A successful MITM phishing attempt usually leaves a trail across identity, device, and network telemetry. The most useful clues are unusual domain activity, repeated but apparently valid authentications, unfamiliar device fingerprints, and token use that begins immediately after credential submission. In a bank environment, those signals matter because the attacker is often trying to reuse the victim’s session before any fraud or step-up verification can interrupt the flow.
Good investigation starts by comparing what the user experienced with what the bank observed. If the user reports nothing unusual but monitoring shows a suspicious login path, that mismatch is itself a warning sign. It suggests the attacker controlled the page or proxying layer well enough to hide the deception from the user while still exposing the authentication transaction to the defender.
For teams that want a deeper control baseline, NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for structuring logging, access control, audit, and session monitoring around those signs. Where the detection problem involves browser relay, token theft, or repeated valid authentication, the control objective is to make the session observable enough that the relay cannot hide in normal traffic.
If the bank can see credential submission followed by immediate token use, that is often a stronger indicator than failed MFA prompts or simple password spraying. The attacker is not trying to break authentication outright, they are trying to reuse the result of a successful authentication before the user or bank can notice.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | phishing-resistant authentication — Phishing-Resistant Authentication | Bank MITM phishing directly attacks the login flow this guidance is meant to harden. |
| Recommendation — Prefer phishing-resistant authenticators to reduce relay-based credential capture and session hijacking. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Detecting suspicious domains, token use, and anomalous sessions depends on continuous monitoring. |
| Recommendation — Correlate authentication, domain, and session telemetry to spot relay-style phishing activity. | ||
| CIS Controls v8 | 5.2 — Establish and Maintain a Secure Configuration Process | Lookalike domains and abnormal login paths are easier to detect when secure baselines and monitoring are in place. |
| Recommendation — Harden and monitor authentication pathways so lookalike-domain activity stands out quickly. | ||
Practitioner Guidance
What to prioritise: Correlate login, token issuance, device fingerprint, and destination domain together rather than reviewing them as separate alerts. A single valid login event is less useful than the sequence around it.
What to verify: Confirm whether the observed session originated from a legitimate bank domain, a known device, and a normal network path. If those three do not line up, treat the authentication as suspect even when the credentials were correct.
Common mistake: Assuming that successful MFA or a “clean” password check means the session is safe. In MITM phishing, success often means the attacker already won the relay and is now racing the user’s real session.
Practitioner takeaway: For banking fraud detection, the best signal is not just that a login succeeded, but that it succeeded in a way the bank cannot reconcile with a trusted domain, trusted device, and normal session behaviour.
Related resources from NHI Mgmt Group
- How should online banking teams defend against man-in-the-middle phishing that intercepts MFA codes and session tokens in real time?
- Why do phishing-resistant methods still fail against man-in-the-middle attacks?
- What are the signs that an organisation’s identity controls are failing against attacker-in-the-middle phishing?
- What are the signs that phishing controls are failing against modern adversary-in-the-middle attacks?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
