Because the attacker captures credentials and the passcode while the session is active, then replays them before the code expires or the user notices the deception. This defeats controls that depend on delayed verification or user-in-the-loop prompts. Phishing-resistant methods reduce that replay window by binding authentication to the real session.
How a live phishing flow defeats one-time passcodes
One-time passcodes are strongest when the code is checked after a delay or against a separate, trusted step. Live phishing collapses that separation. The attacker runs a real-time relay, captures the password and the OTP while the user is still engaged, and immediately uses both before the code expires or the user realises the prompt was fake.
That is why the control failure is not “OTP is useless”, but “the attacker is present at the same time as the legitimate user”. The authentication step is still valid in isolation, yet the adversary turns it into an access channel by staying inside the interaction window and reusing the freshly issued proof.
In practice, this means the defender is not only validating possession of a code, but also the timing and context of the transaction. If the system does not bind the factor to the actual session, device, or origin, the code can be replayed in a parallel session that looks acceptable to the identity provider.
Why timing, replay and user trust matter more than the code itself
Many MFA designs assume the user will notice something wrong before an attacker can act. Live phishing breaks that assumption by keeping the exchange fast, convincing and synchronous. The code is harvested while it is still fresh, which makes short expiry helpful but not sufficient on its own.
Security teams should think of this as a race condition between human verification and attacker automation. The user believes they are completing a legitimate sign-in, while the attacker is using the same artifacts to finish the session elsewhere. The protection fails when the defender has no stronger signal than “the right code arrived on time”.
This is why phishing-resistant methods change the outcome. Instead of accepting a transferable code, they cryptographically bind the authentication event to the origin and session the user actually intended, which removes the attacker’s ability to relay the proof into a separate login flow.
What breaks in real environments and what reduces takeover risk
Live phishing becomes especially effective when organisations still rely on SMS, email OTPs, or app-generated codes as the main second factor. Those methods can be intercepted, relayed, or socially engineered during the login sequence. The weakest designs also make recovery flows, help-desk resets, and step-up prompts part of the same attack path.
A strong reference point is NHIMG’s MFA Guide, which shows how relay attacks, fatigue, and token theft defeat weaker factors and why phishing-resistant MFA is the better endpoint. For broader identity controls around account takeover and recovery abuse, see the Customer IAM (CIAM) Guide.
For a concrete attack pattern, NHIMG’s Twilio 0ktapus breach 2022 is a useful example of how one-time codes can be captured in real time and then used to reach downstream accounts. The lesson is that the attacker does not need to break the code generation mechanism, only the trust relationship around the live sign-in.
If you want a control benchmark, NIST’s Digital Identity Guidelines are useful because they distinguish between weaker authenticators and phishing-resistant approaches that bind the authenticator to the transaction and origin. For implementation guidance, CIS Controls v8 remains a solid way to connect identity hardening to account management and access protection.
Risk and Threat Considerations
Live phishing is dangerous because it converts a short-lived credential into immediate account compromise before the user or the platform can intervene. The exposure increases when the same account also has access to sensitive data, admin functions, or recovery channels that let the attacker lock in persistence.
Failure mechanism: The attacker relays the login in real time, captures the OTP or other second factor while it is still valid, and completes authentication in a separate session that the victim does not control.
Impact: The account can be taken over without malware, making password resets, session hijacking, data theft, fraud, and follow-on phishing much easier once the attacker is inside.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Covers phishing-resistant authentication and binding to the real session. |
| Recommendation — Prefer phishing-resistant authenticators that bind login to the user’s session and origin. | ||
| CIS Controls v8 | 5 — Account Management | Account access and recovery paths are where live-phishing takeovers are exploited. |
| Recommendation — Harden account and recovery controls to reduce replayable sign-in abuse. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Organizational user sign-in must resist relay and credential replay. |
| Recommendation — Use stronger user authentication controls that limit replayable access. | ||
| OWASP ASVS | V6 — Authentication | Authentication assurance is the core issue when OTPs are relayed in real time. |
| Recommendation — Require authentication designs that resist phishing and session relay attacks. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Live phishing exploits weak or transferable authentication material. |
| Recommendation — Eliminate transferable authenticators that can be replayed during live phishing. | ||
Practitioner Guidance
What to prioritise: Treat any factor that can be replayed live as a transitional control, not a final defence. Move the highest-risk populations first, including privileged users, support staff, and accounts with recovery authority.
What to verify: Confirm that the chosen authentication method is origin-bound or otherwise resistant to relay, and test the full sign-in path, including recovery and step-up prompts. If those paths still accept transferable OTPs, the control gap remains.
What good looks like: Users complete authentication only through methods that cannot be forwarded into a different session, and help-desk or fallback flows do not silently reintroduce the same replay window.
Practitioner takeaway: The real problem is not the code, it is the fact that the attacker can use the code in the same moment the user does. Reduce takeover by removing replayability, not by assuming shorter expiry alone will stop the attack.
Related resources from NHI Mgmt Group
- Why do one-time passcodes still fail against modern phishing campaigns?
- Why does adaptive authentication reduce account takeover risk compared with one time passcodes or push approval alone?
- Why do phishing and weak login habits still lead to account takeover?
- Why do stolen personal details still lead to account takeover?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org