I think that this attack is not possible to prevent without hardware tokens. At least user will be immediately aware that something's not quite right.