MFA Testing Checklist

Cover enrollment Test first-time setup, QR code display, backup code generation, and what happens if the user abandons enrollment halfway through. ## Cover verification Try valid codes, expired codes, reused codes, incorrect codes, and too many failed attempts. Error messages should be helpful without leaking sensitive details. ## Cover recovery Recovery flows need careful testing because they are often where account security and user support collide. Check backup codes, reset paths, and admin-assisted recovery. ## Cover remembered devices If the product supports trusted devices, test device removal, browser changes, cookie clearing, and expiration.