--- title: "How the Latest Scam Shows Two-factor Authentication Doesn’t Prevent Phishing | DuoCircle" description: "The only thing most people know about two-factor authentication (2FA) is that it’s supposed to make online activity safer, and for the most part, it does." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/" --- Quick Answer Two-factor authentication does not stop phishing when the attack is designed to harvest both credentials and the OTP in real time. A Citibank-targeted phishing campaign documented by Bleeping Computer used a convincing domain, valid TLS certificates, and a fake login page. When the victim entered credentials, the phishing site logged into the real Citibank account, which triggered Citibank to send an OTP to the victim's phone. The phishing page then asked for the OTP, captured it, and completed the login. Because the OTP arrived from Citibank's own servers, it reinforced the illusion of legitimacy. The whole attack depends on the victim trusting the spoofed domain. Defenses that detect domain-name spoofing and display-name spoofing at link-click time block the user from reaching the fake page in the first place, regardless of how convincing the page looks. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20the%20Latest%20Scam%20Shows%20Two-factor%20Authentication%20Doesn%E2%80%99t%20Prevent%20Phishing&url=undefined%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F&title=How%20the%20Latest%20Scam%20Shows%20Two-factor%20Authentication%20Doesn%E2%80%99t%20Prevent%20Phishing "Share on Reddit") [ ](mailto:?subject=How%20the%20Latest%20Scam%20Shows%20Two-factor%20Authentication%20Doesn%E2%80%99t%20Prevent%20Phishing&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F "Share via Email") ![Prevent Phishing](https://media.mailhop.org/duocircle/images/2020/01/spf-record-generator-3175.jpg) The only thing most people know about **two-factor authentication** (2FA) is that it’s supposed to make online activity safer, and for the most part, it does. But, as you’ll see, _it doesn’t do anything to protect you from a phishing attack if the phishing attack is really good_. [![Bleeping Computers](https://media.mailhop.org/duocircle/images/2020/01/spf-validator-3432.jpg)](https://media.mailhop.org/duocircle/images/2020/01/spf-validator-3432.jpg) According to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/this-citibank-phishing-scam-could-trick-many-people/), one of these “really good” phishing attacks was aimed at customers of Citibank. What makes this **phishing attack** really good? It “utilizes a convincing domain name, TLS certs, and even requests OTP codes that could easily cause people to believe they are submitting their personal information on a legitimate page.” > _Did you catch that? It uses a one-time-PIN or OTP codes. In other words, two-factor authentication._ How does the scam work? The first part is just like any other phishing attack. _The hackers convince you to login to their real-looking but fake website_. If you do provide the login data, in the background the hackers will be logging into your Citibank account. What happens next is what makes the scam so good. “If the phishing site does indeed login to the Citibank account and a user has an OTP (One-Time PIN) authentication configured on their account, it will trigger Citibank to send the code to the victim’s cell phone number. _As this code will be sent from Citibank’s servers, it further lends authenticity to the phishing site_. The phishing page then asks the victim to enter their OTP to continue.” 2FA didn’t do you a damn bit of good, did it? _The same **scam website** that got your login credentials was also be used to grab your OTP code_. Once you’re scammed, the phishing landing page will redirect you back to the Citibank login page. Good luck figuring out what to do next. How do you **protect yourself** and others in your organization from attacks like this? There’s a clue in the paragraph above: _convincing domain name_. \_The whole ruse depends on your being convinced that the fake domain is rea\_l. It’s called [domain name spoofing](https://www.barracuda.com/glossary/domain-spoofing) and it’s the cornerstone of most phishing attacks. Once you fall for it, the rest of the con is easy. But, if you can detect it upfront, you have a good chance of escaping unharmed. What’s the best way to make sure you don’t get domain name spoofed? Use technology that doesn’t fall for domain name spoofing. _Use technology that doesn’t care how closely the fake website resembles the real one_. Use technology like that from [DuoCircle](/). [![Phishing Protection](https://media.mailhop.org/duocircle/images/2020/01/spf-record-generator-4392.jpg)](https://media.mailhop.org/duocircle/images/2020/01/spf-record-generator-4392.jpg) [Phishing Protection](/email/phishing-protection) from DuoCircle is **cloud-based email security** with real-time click protection which doesn’t fall for domain name spoofing (or any other phishing tactic). And because it’s cloud-based, _it requires no hardware, software or maintenance. It sets up in minutes and only costs pennies per user per month_. Don’t be fooled into thinking 2FA makes you safe from hackers. Get **Phishing Protection** from DuoCircle and stop worrying about it altogether. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F) [ ](https://twitter.com/intent/tweet?text=How%20the%20Latest%20Scam%20Shows%20Two-factor%20Authentication%20Doesn%E2%80%99t%20Prevent%20Phishing&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fhow-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing%2F) Copy Related Articles - [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg) AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/) - [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg) 10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/) - [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg) 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/) - [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg) 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How the Latest Scam Shows Two-factor Authentication Doesn’t Prevent Phishing","description":"The only thing most people know about two-factor authentication (2FA) is that it’s supposed to make online activity safer, and for the most part, it does.","url":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/","datePublished":"2020-01-29T20:49:28.000Z","dateModified":"2025-05-22T18:09:53.000Z","dateCreated":"2020-01-29T20:49:28.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/"},"articleSection":"phishing-protection","keywords":"","wordCount":485,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/01/spf-record-generator-3175.jpg","caption":"Prevent Phishing","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"How the Latest Scam Shows Two-factor Authentication Doesn’t Prevent Phishing","item":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"How the Latest Scam Shows Two-factor Authentication Doesn’t Prevent Phishing","item":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How the Latest Scam Shows Two-factor Authentication Doesn’t Prevent Phishing","description":"The only thing most people know about two-factor authentication (2FA) is that it’s supposed to make online activity safer, and for the most part, it does.","url":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/","datePublished":"2020-01-29T20:49:28.000Z","dateModified":"2025-05-22T18:09:53.000Z","dateCreated":"2020-01-29T20:49:28.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/how-the-latest-scam-shows-two-factor-authentication-doesnt-prevent-phishing/"},"articleSection":"phishing-protection","keywords":"","wordCount":485,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/01/spf-record-generator-3175.jpg","caption":"Prevent Phishing","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```