Troubleshoot Customer TFA

The account dashboard has no TFA controls

Check Enable TFA for Customers in the current store scope. The management block and account navigation link are hidden while the feature is disabled.

The setup code is always rejected

Reload setup and scan the new QR code. The previous secret may have exceeded Setup Secret Lifetime. Also confirm that the authenticator device and Magento server use accurate time.

Remove stale duplicate entries from the authenticator app so the customer does not select a code for an expired secret.

This is expected for an enrolled customer. Magento holds authentication in a pending state until the TFA page accepts an authenticator or recovery code.

If the verification page loops, check store scope, session/cookie configuration and whether a custom login implementation bypasses Magento's regular or AJAX customer login actions.

Too many invalid attempts

The pending TFA login was cancelled after the configured limit. Return to the customer login page and start again with email and password. The limit does not permanently lock the customer account.

A recovery code no longer works

Every recovery code is single use. Regenerating codes also invalidates the entire previous set. Try an unused code from the newest set or follow the verified Admin reset process.

Recovery codes disappeared from the success page

Their plain-text values are read from the session once. They are not shown again on the dashboard. Regenerate the set and save the newly displayed values immediately.

The customer cannot disable TFA

Mandatory TFA prevents disablement. When TFA is optional, the customer still needs the correct current Magento password.

Check Disable TFA During Admin Login as Customer. It is enabled by default. Disable that bypass when assisted sessions must complete the customer's TFA challenge.

The authenticator shows an unfamiliar name

The label uses Issuer Name plus the customer email. Update the issuer to a recognizable store name. Existing authenticator entries keep the label they received when scanned; customers must re-enroll to replace it.