After entering their password correctly, they're sent to a 6-digit verification step (/auth/2fa), or they can use a one-time recovery code instead. Verification is rate-limited to 5 attempts before it locks out with "Too many failed attempts. Please try again later." Every failed and successful attempt is written to the security log.