[jeremygaither]

Services like AWS do this. Requiring them to provide at least one (if not two) generated codes before proceeding ensures they have at least captured the 2FA code.