PLEASE ANSWER CAREFULLY - CAREFULLY. thank you

A company has implemented a two-factor authentication system, An automated phishing attack spoofed the portal to capture usernames, passwords, and one-time tokens and replayed the information to the company portal. Which of the following should the company consider implementing to prevent this type of attack? A) Push-based tokens B) Time-based one-time passwords C) HMAC-based one-time passwords D) Single sign-on authentications