A financial services company recently suffered an incident where an attacker obtained employee credentials via a phishing site and then used a real-time relay to intercept the one-time passcodes users typed in, successfully logging into the VPN. Leadership wants the security team to strengthen the MFA strategy so that a stolen password AND an intercepted code cannot be replayed by an attacker. Which MFA approach best meets this requirement?