2FA via Email Verification Code at Login

Problem Statement

Client sites currently authenticate end users with a single factor (password only), leaving accounts vulnerable to takeover if credentials are compromised. There is no email-based verification step at login to confirm the person signing in is the legitimate account owner.

User Story

As an end user logging into a client's site, after I enter my correct credentials I want to receive a one-time verification code at the email address on my account, and I should not be able to access or interact with the site until I've entered that code, so that my account stays protected even if my password is compromised.

Definition of Done

• On successful password validation, a one-time verification code is generated and sent to the email address on record for the account (not a user-entered address).

• The user is shown a verification screen and cannot access any part of the client site until the code is confirmed — enforced via a limited "pending verification" cookie/session state that grants no access to protected routes, APIs, or content.

• The full authenticated session cookie is only issued after the code is confirmed.

• Codes are single-use, numeric, cryptographically random, and expire after a short window (e.g. 10 minutes).

• Requesting a new code invalidates any previously issued code.

• Code requests/resends are rate-limited, and verification attempts per code are capped (e.g. 5 tries) with escalating lockout/backoff to prevent brute-forcing.

• Verification attempts (success/failure, timestamp, IP) are logged for audit and abuse detection, without storing the code itself in plaintext logs.

• Users have a clear resend option and guidance if the email doesn't arrive, plus a support fallback path.

• The unverified/pending state cannot be bypassed via direct URL access, deep links, or stored client-side state.

• SMS, authenticator apps (TOTP), and changes to the core password authentication flow are explicitly out of scope.