The second factor only protects you if the code is single-use, rate-limited and non-negotiable. Break one assumption and the account is wide open.
The code is not single-use and can be replayed. The verify endpoint has no rate limit, so it is brute-forced. Verification races with resend, so one code is reused across attempts. Or a fallback path — an API version, a legacy login, a support reset — skips the code entirely.
Two-factor is a chain, and the attacker only needs the weakest link. The link is almost never the crypto — it is the resend, the retry counter, or the fallback.
OTP is often the last gate before money moves: a transfer, a withdrawal, a card confirmation. If the code is bypassable, the attacker is not reading data — they are moving funds. That turns a convenience flaw into a financial one.
It can be — SIM swap and SMS interception add risk. The bigger issue is almost always the verification logic, not the channel.
On isolated accounts and agreed test numbers only — never against real customer accounts.