Number matching doesn't prevent phishing. When a potential victim enters their password into a fake login page, the attacker simply needs to initiate a login us

Number matching doesn't prevent phishing. When a potential victim enters their password into a fake login page, the attacker simply needs to initiate a login using the provided password and forward the number challenge to the fake page. Sibling thread mentions alternatives that prevent this albeit at the cost of additional technology in the user agent, authenticator, and relying party.