HUMAN VERIFICATION REQUIRED ASVS 6.6.2 Bind OOB challenge

Out-of-band authentication requests, codes, or tokens are bound to the original authentication request for which they were generated and are not usable for a previous or subsequent one.