Hello,
I am posting this to document a critical design flaw in OpenAI’s recent MFA migration that has completely locked me out of my account, along with all my sites and projects.
-
The Migration Trap: During the migration prompt, the system allowed me to verify via my email address—acting as if I was confirming the migration. However, instead of validating that an actual authenticator app was bound via a QR code test, it treated the email verification as a complete transition, stripped away email verification as a fallback, and locked me into a strict Authenticator App requirement I never successfully set up.
-
Current State: Because email fallback is completely gone and I never had a TOTP app generated, every login attempt hits a dead end. Changing my password in an attempt to reset the flow only succeeded in logging me out of all active devices.
-
The Flaw: A secure migration flow should never deprecate an existing fallback method until a live test token from an authenticator app is successfully entered and confirmed. Instead, the backend stripped out email verification based on a step that didn’t actually verify an authenticator app existed, instantly bricking access.
Standard automated support responses keep telling me to “just turn it off in settings” or “use fallback methods,” failing to realize those options have been entirely removed by the migration itself, and changing settings requires the very code I am locked out of.
If any OpenAI staff or community leads can flag this account-recovery escalation: manual intervention on the backend is required to unbind the broken MFA state when email/SMS fallbacks have been prematurely stripped.