Just set a timer after entering the password in every single case (only stopped early by successful MFA). "authentication did not succeed, one or more factors may be incorrect or may have failed verification"