A setup is functioning more like two-step verification when the password and the TOTP code are both retrieved from the same device or application. In that case, the second step still adds friction for attackers, but it does not create a fully independent factor. The key signal is whether a device compromise would expose both secrets together.
How to tell when “2FA” is really just two-step verification
The practical test is whether the second step is independent from the first. If the password and the TOTP code can both be obtained from the same unlocked device, browser profile, password manager, or authenticator app, the setup behaves more like two-step verification than true two-factor authentication. The protection still slows attackers, but it does not fully separate the secrets.
What makes a second step non-independent
A genuine second factor should come from a different trust boundary than the password. If one device compromise, one browser session theft, or one app takeover reveals both the password and the one-time code, the control is still useful, but the factors are not meaningfully isolated. That is the core sign practitioners should look for, because the attacker only needs one foothold to recover both steps.
Common failure patterns include password autofill inside the same compromised browser, copied TOTP seeds synced to the same cloud account, and recovery flows that let the attacker reset both factors through the same channel. In those cases, the setup adds friction and detection opportunities, but it does not force the attacker to defeat two separate sources of proof.
What a genuinely stronger 2FA setup looks like
The stronger pattern is separation of possession, recovery, and storage. The password may live in a password manager, but the second factor should be protected by a distinct device, hardware security key, or phishing-resistant authenticator path that is not recoverable from the same compromise. When the second factor survives a single device compromise, it is acting as an independent factor rather than a duplicated step.
For teams choosing between MFA styles, the key question is not whether the login flow has two prompts, but whether compromise of one endpoint or secret collection path collapses both prompts at once. A setup that resists session theft, sync compromise, and shared-device exposure is materially stronger than one that merely makes the user enter two values.
Risk and Threat Considerations
The main risk is false assurance. Users and administrators may treat a password plus TOTP setup as if it blocks account takeover, when in practice a compromised phone, browser, cloud sync account, or password manager can expose both factors together. Attackers prefer these shared paths because they turn “two steps” into one compromise event.
Failure mechanism: The attacker compromises the device, browser profile, recovery channel, or synced secret store that holds both the password and the TOTP source, then uses the recovered material to authenticate without needing a second independent factor.
Impact: The account is easier to take over, phishing resistance remains limited, and the organisation may underestimate the real blast radius of a single endpoint compromise or sync-account breach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V10 — OAuth and OIDC | Covers authentication assurance and second-factor flow weaknesses. |
| Recommendation — Use V10 to require stronger authentication flows and resistant second-factor handling. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Addresses authenticator strength and independence between factors. |
| Recommendation — Adopt NIST 800-63 guidance to distinguish true multi-factor authentication from shared-secret second steps. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle and protection of passwords, OTP seeds, and recovery material. |
| IA-2 — Identification and Authentication (Organizational Users) | Relevant because the question concerns user authentication strength and factor separation. | |
| Recommendation — Apply IA-5 to protect, rotate, and store authenticators so one compromise does not expose both factors. Apply IA-2 to ensure login assurance is based on independent authentication evidence. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Supports limiting account takeover paths and strengthening authentication choices. |
| Recommendation — Use CIS-6 to reduce shared recovery paths and enforce stronger authentication methods. | ||
Practitioner Guidance
What to verify: Check where the password and the second factor are stored, how they are backed up, and whether a single session or device compromise can expose both. If both secrets are recoverable through the same platform or recovery flow, treat the setup as weaker than the label suggests.
Decision rule: If one compromised device or cloud account can reveal both factors, prioritise stronger factor separation, such as phishing-resistant authenticators or hardware-backed methods, over adding more prompts to the same flow.
Practitioner takeaway: The label “2FA” matters less than the failure domain, if one compromise collapses both factors, the control is only superficially two-factor.
Related resources from NHI Mgmt Group
- What breaks when organisations treat backup codes as an afterthought in two-step verification?
- What is the difference between a push-based prompt and an authenticator app for two-step verification?
- How should organisations handle login verification for password vault users who have not enabled two-step login?
- When does two-step verification reduce risk, and when can it create more operational exposure than it removes?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
