without access to the victim’s mobile device or phone number. The idea is that even if the user’s password gets stolen, the attacker still can’t access the user’s account without that second factor - i.e.

Many websites now require users to supply both a password and a numeric code/OTP token sent via text message, or one generated by mobile apps like Authy and Google Authenticator.

An ad for the OTP interception service/bot “SMSRanger.”