Watch what the “verify” step actually sets. The gate on this page is a cookie the client fully controls — the second factor can be skipped without ever knowing a code.