AWS MFA Bypassing?

Might want to lock accounts temporarily, but I'm able to login to MFA secured account by entering bad code, then hitting login again once rejected. Anyone else seeing this?