Arguably, "phishing a credential" doesn't necessarily have to mean full compromise of the credential itself. For example, in the case of SMS-OTP, the credentia

Arguably, "phishing a credential" doesn't necessarily have to mean full compromise of the credential itself. For example, in the case of SMS-OTP, the credential is (access to) the registered phone number, yet I'd still call an attack that successfully intercepts one OTP in time to use it a successful phishing attack.