Easy to enter.
Hard to abuse.

OTP-first authentication keeps genuine users moving while LOFOR quietly records security signals, protects sessions and raises verification only when risk increases.