Found a whole new level of security incompetence. Went to type in my 2FA code, but nothing appeared on screen. They hadn't disabled pasting. Instead, they used JavaScript to ensure that only numbers could be typed in. But only numbers from the number row of my keyboard. I was using my NumPad which, as every good developer knows, uses different event codes! https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/code