It should be easily possible to extend the TOTP standard, so you also have to enter a number, before you get the code. But I think it will always be possible t

It should be easily possible to extend the TOTP standard, so you also have to enter a number, before you get the code. But I think it will always be possible to do some kind of real time MITM attack, where you trick a user into accepting your fraudulent login.