Man-in-the-middle is an attack that secretly intercepts the communication between two parties, over rogue Wi-Fi, spoofed sites, or compromised networks, to steal or quietly change data such as credentials, one-time codes, or payment details. Both sides believe they are talking directly to each other, while the attacker sits in the middle reading and sometimes altering everything that passes.
What is man-in-the-middle, in plain English?
Man-in-the-middle, often written MitM, means an attacker quietly inserts themselves into a two-way conversation. Instead of hacking either endpoint, they position on the path between them: a fake Wi-Fi hotspot in a cafe, a spoofed login page, a poisoned DNS entry, or a compromised router. Every message flows through the attacker, who can read it, copy it, or change it before passing it along. To the victim, nothing looks unusual.
The goal is usually to harvest credentials, one-time codes, session tokens, or payment details. A dangerous modern variant is real-time code-relay phishing, sometimes called an adversary-in-the-middle kit, which forwards a stolen one-time code to the real site within seconds. That defeats basic two-factor authentication, because the second factor is intercepted and reused before it expires.
In the fraud stack, MitM is an interception attack that typically feeds account takeover. It differs from man-in-the-browser: MitM sits on the network between the parties, while man-in-the-browser sits inside the victim's own browser. Both aim to slip between what the user thinks is happening and what actually happens.
How a man-in-the-middle attack works
The pattern is intercept, relay, and exploit, often in real time:
- Position — Get in the middle. The attacker sets up a rogue hotspot, spoofed site, or compromised network so traffic must pass through them.
- Lure — Route the victim in. A phishing link, an evil-twin Wi-Fi name, or a DNS trick sends the victim onto the attacker's path.
- Relay — Pass data both ways. The victim interacts with what looks like the real service while the attacker forwards traffic and captures credentials and codes. ReadPassive theftCopy credentials, tokens, and card details as they pass. AlterActive tamperingChange a payee or amount, or relay a one-time code to the real site.
- Exploit — Take over. The captured session or credentials are used to log in, drain funds, or authorize a transfer.
What it looks like in practice
In practice
A traveler joins airport Wi-Fi named after the terminal lounge, not realizing it is an evil twin run from a laptop nearby. They open their bank app through a captive portal that quietly proxies the traffic. Everything looks normal, and they log in and approve a one-time code.
The attacker relays that code to the real bank within seconds and rides the authenticated session to add a new payee and move funds. The victim sees no error at the time. The takeover only becomes visible hours later as a payment they never made.
Why it matters for operators
Man-in-the-middle undermines the assumption that a successful login and a valid one-time code prove a legitimate customer. Real-time relay kits mean the second factor can be intercepted and reused faster than it expires, so SMS and app-based codes are no longer a hard stop. That pushes defenders toward phishing-resistant login such as FIDO2 and passkeys, which bind the credential to the real site and break when the domain is wrong.
For teams, the takeaway is to treat anything typed over an untrusted network as potentially compromised and to lean on layered signals: certificate and TLS checks, device and session risk, and behavioral analytics that can flag a session behaving unlike the genuine customer even after a clean login.
What to watch for
- Impossible travel or network oddities. A login and a code approval from a location or network that does not match the customer's normal pattern.
- Real-time code relay. A one-time code entered and consumed within seconds on a session that then immediately adds a payee or moves money.
- Certificate and TLS warnings. Sessions preceded by cert errors, downgraded encryption, or unexpected redirects suggest interception.
- Untrusted networks. Sensitive actions taken over public or unfamiliar Wi-Fi carry higher interception risk.
- Post-login takeover signs. New device enrollment, payee changes, or contact-detail edits right after authentication point to a relayed session.
Quick questions
Does HTTPS stop man-in-the-middle?
Proper TLS with valid certificate checks blocks the classic network interception. But phishing-based adversary-in-the-middle kits sidestep it by getting the victim to interact with a fraudulent site that proxies the real one, so encryption alone is not enough.
How does it defeat two-factor authentication?
Real-time relay kits capture the one-time code as the victim enters it and forward it to the genuine site within seconds. Because the code is used before it expires, SMS and app-based second factors provide little protection.
What actually resists it?
Phishing-resistant authentication such as FIDO2 and passkeys binds the login to the correct domain, so a relayed session on a fraudulent site simply fails. Certificate pinning and strict TLS also help on the network side.
How is it different from man-in-the-browser?
Man-in-the-middle sits on the network between the user and the service. Man-in-the-browser sits inside the victim's own browser as malware. Both intercept the session, but the location and the defenses differ.
Is public Wi-Fi really that risky?
Open networks make evil-twin and interception attacks easier, though modern encryption reduces passive sniffing. The bigger risk today is being lured through a spoofed page, which can happen on any network.
What is session hijacking's relationship to this?
Session hijacking is stealing an authenticated session token, which a man-in-the-middle attack can accomplish. Once the attacker holds a valid token, they can act as the user without needing the password or code again.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.