TOTP based multi factor authentication for sensitive actions

I use MFA not only at login but also for high-risk step-up flows like email change or payout setup. TOTP is straightforward to implement if secrets are handled carefully and backup codes are part of the design. Recovery flow quality matters as much as the happy path.