MFA Testing Checklist

Cover enrollment

Test first-time setup, QR code display, backup code generation, and what happens if the user abandons enrollment halfway through.

Cover verification

Try valid codes, expired codes, reused codes, incorrect codes, and too many failed attempts. Error messages should be helpful without leaking sensitive details.

Cover recovery

Recovery flows need careful testing because they are often where account security and user support collide. Check backup codes, reset paths, and admin-assisted recovery.

Cover remembered devices

If the product supports trusted devices, test device removal, browser changes, cookie clearing, and expiration.