The statement is true because once an attacker has captured valid credentials through a phishing attack or a similar method, they can reuse those credentials to access the system that recognizes them. In Alice's case, she entered her legitimate credentials into a fake website, which the attacker can now use in a credential replay attack to gain unauthorized access to her company's services.