I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:
"In authentication, out-of-band refers to utilizing two separate networks or channels, one of which being different from the primary network or channel, simultaneously used to communicate between two parties or devices for identifying a user. A cellular network is commonly used for out-of-band authentication. An example of out-of-band authentication is when an online banking user is accessing their online bank account with a login and a one time password is sent to their mobile phone via SMS to identify them. The primary channel would be the online login screen where the user enters their login information and the second separate channel would be the cellular network. This added layer of security prevents the likelihood of hackers and malware from compromising access to the complete authentication process, however, this method of authenticating a user is known to be vulnerable to man-in-the-middle (MITM) attacks."
Can someone please explain why the bold line stands true? To put it in a different way, how is an out of band authentication like sms vulnerable to man in the middle attacks?