The phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attack

The phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attacker can be a man-in-the-middle and make the victim authorize a costly transaction (say $100), with the victim seeing a cost of $1. These is an example video here: https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm... Of course, the real transaction can be seen from the bank.