Standard Two Step Authentication does usually require three steps. Logging in, email, and then a phone call or text.
Your two step authentication is not very good... not very user friendly.
Makes me want to pull my hair out.
