use a real loop for 2fa checks