What is a replay attack?
Definition
A replay attack is when an attacker records a valid message between two parties, such as a login exchange, and sends it again later to pass as the real user or system.
- Category
- Attacks
- Also called
- playback attack
- Last updated
NIST defines a replay attack as one in which the attacker is able to replay previously captured messages between a legitimate claimant and a verifier to masquerade as that claimant to the verifier, or vice versa. The attacker doesn't need to crack a password or understand the message. They only need a copy of something that already worked once.
How it works
Imagine you log in to a service, and your device sends a message that proves who you are. Someone watching the connection, for instance on an unsafe network, saves that message. Later they send the same message to the service. If the service accepts it, it believes it is talking to you.
The "or vice versa" in NIST's wording matters too: an attacker can also replay a server's messages to fool you into thinking you are talking to the real service.
Why it matters to you
Most people never meet a replay attack directly, because well-built services defend against them. The defence is making each message usable once, for example by tying it to a one-time code or a timestamp. That is one reason a one-time code from an app is safer than a fixed value that never changes. Where a service uses reusable, static proof of identity, a captured copy keeps working.
Replay attack vs. related terms
- Phishing tricks you into handing something over. A replay attack needs no trick on you: it reuses a message that was already sent.
- Credential stuffing tries stolen username and password pairs on many sites. A replay attack reuses a captured message, not a password you typed.
How to protect yourself
- 1
Turn on two-step verification
One-time codes change with each login, so a captured copy of an earlier code is useless. Prefer an authenticator app or a security key over a text message where you can.
- 2
Avoid public Wi-Fi for sensitive logins
Capturing messages is easiest on a network you don't control. Use your phone's mobile data for banking and email when you're out.
- 3
Stick to sites and apps that use HTTPS
Look for the lock icon in your browser. Encrypted connections make it much harder for someone nearby to capture your messages.
- 4
Keep devices and apps updated
Updates fix weaknesses in how software proves who you are, including ones that make replay possible.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a replay attack the same as a man-in-the-middle attack?
They are related but different. A man-in-the-middle sits between two parties and can change what passes through. A replay attack only needs a saved copy of an earlier message and sends it again.
Does two-factor authentication stop replay attacks?
One-time codes help a lot, because a code that was already used or has expired won't work a second time. How well it works depends on how the service checks the code.
Can I tell if I've been the target of one?
Usually not directly. You might see a login or action on your account that you didn't make. If so, change your password and review your account's recent activity.
Sources
Something wrong or out of date? Tell us and we'll re-check it.