Scope note: this is an additive, mobile-shaped combined status view (2FA + contact verification in one screen) for the TWA app shell — it does not replace the approved desktop account-security/01-hub.html entry point, nor mfa-management/01-mfa-overview.html's enrol/manage flows. It reuses their chip/badge language. Password state is out of scope for this screen (owned by account-security/02-states.html) — not duplicated here.

Default · loaded
Security
Two-factor authentication
Authenticator appPrimary factorActive ›
Text message•••• •• 4471Active ⋯
Contact verification
Emaila•••@rowan.coVerified
PhoneNot confirmed yetUnverified ›
Loading · fetching status
Security
Two-factor authentication
Contact verification
Error · couldn't load status (retry, never a stale guess)
Security

Couldn't load your security status

We don't show factor or verification state we can't confirm. Try again.

Fail-closed · remove/disable last 2FA factor → 409 BLOCKED
Security
Two-factor authentication
Authenticator appOnly active factorActive ⋯

Can't remove your last method

Two-factor authentication is required on this account, and this is your only active factor. Add another method before removing this one — you can't lock yourself out.

Frame 04 / 04 · Security status (profile) · /account/security — 375px (Android TWA)

Review · mfa-stepup-mobile approve or reject each flow ↓
mfa-stepup-mobileapproved · izzywdev
confirm-contact-phoneapproved · izzywdev
security-status-mobileapproved · izzywdev