From RFC 4226:
7.4. Resynchronization of the Counter
Although the server's counter value is only incremented after a
successful HOTP authentication, the counter on the token is
incremented every time a new HOTP is requested by the user. Because
of this, the counter values on the server and on the token might be
out of synchronization.
We RECOMMEND setting a look-ahead parameter s on the server, which
defines the size of the look-ahead window. In a nutshell, the server
can recalculate the next s HOTP-server values, and check them against
the received HOTP client.
Synchronization of counters in this scenario simply requires the
server to calculate the next HOTP values and determine if there is a
match. Optionally, the system MAY require the user to send a
sequence of (say, 2, 3) HOTP values for resynchronization purpose,
since forging a sequence of consecutive HOTP values is even more
difficult than guessing a single HOTP value.
The upper bound set by the parameter s ensures the server does not
go on checking HOTP values forever (causing a denial-of-service
attack) and also restricts the space of possible solutions for an
attacker trying to manufacture HOTP values. s SHOULD be set as low
as possible, while still ensuring that usability is not impacted.