July saw a spike in “2FA Fatigue” and interception scams. Scammers used automated bot services to call victims, posing as their bank’s fraud department. They told the victim they were sending a “verification code” to stop a fake transaction and asked the victim to read it back. In reality, the scammer was trying to log into the victim’s account and needed the 2FA code to get past the security layer. This highlights that 2FA is only secure if users never share their codes with anyone.