U2F works because it is replay protected. Whatever you "authorize" the scammer to do means nothing to the bank when he tries to relay it. Either he acts as a t

U2F works because it is replay protected. Whatever you "authorize" the scammer to do means nothing to the bank when he tries to relay it. Either he acts as a transparent proxy between you and your bank without attacking, or the authentication fails. Edit: with local malware you're doomed unless you have trusted external hardware with a dedicated screen.