How to detect suspicious tokens collected by a hacker

Question

I previously asked a question here What's the use of adding a challenge in the otp algorithm?

Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious activity with them ? For example if the user creates another token and uses it and hackers use previous tokens, could server detect this as weird because user shouldn't have used new token before previous ones ?

Answer 1

Sure, but this makes a certain set of assumptions.

1. The OTP is event-based, not time-based
2. You have to be tracking previously used tokens
3. You have to track expected future tokens
4. The user doesn't have the ability to reset their OTP sequence with the initial seed

In theory with an event-based OTP once you use it anything generated before it is unsuable because the server should only be expecting OTP's generated after the current one. So if an attacker collected unused OTPs they wouldn't work after the user authenticates with the latest OTP.