Question

A financial services firm keeps suffering account takeovers despite mandating SMS one-time passcodes as a second factor. Attackers use convincing proxy phishing sites that capture the user's password and relay the OTP in real time. The security architect is asked to select an authentication method that will structurally defeat this real-time relay (adversary-in-the-middle) technique. Which approach best meets the requirement?

Accepted Answer

Deploy FIDO2/WebAuthn hardware security keys that bind the credential to the origin and use challenge-response public-key cryptography

Answer

Replace SMS OTP with time-based one-time passwords (TOTP) generated by an authenticator app

Answer

Add knowledge-based security questions as a third authentication factor

Answer

Increase the length of the SMS OTP from six to eight digits and shorten its validity window