[dools]

I called this a "replay attack" because it sounds more like this:

"A replay attack in a network communications setting involves intercepting a successful authentication process—often using a valid session token that gives a particular user access to the network—and replaying that authentication to the network to gain access"

Even though this wasn't a session token, it was an authentication process and token, gathered from a fraudlent source and replayed to a valid source.

MITM is:

"A man in the middle (MITM) attack is a general term for when a perpetrator positions himself in a conversation between a user and an application—either to eavesdrop or to impersonate one of the parties, making it appear as if a normal exchange of information is underway."

So to me a MITM would be more like using a wifi access point to access the correct banking URL, but the service carrying the data was acting maliciously.