One way to mitigate the risks of these attacks is by enabling the allow listed hosts for pin entry feature. With this setting, you specify the sites where your pin codes can be used.  If a user uses your pin code on another website, Rescue will detect that they are in the wrong place and automatically redirect them to your website.  

How does this help? 

In some cases, clicking “start session” on a malicious user’s page is what would trigger an action like installing malware or viruses, scraping personal information, or presenting fake error messages with false contact information putting the user in contact with a scammer. With this feature, Rescue would redirect the user to the legitimate site before this could happen.