I think when compared with a breach in 2FA, changing your password is a good counter. But I agree that in the case of failed 2FA (total failure), an alert shou

I think when compared with a breach in 2FA, changing your password is a good counter. But I agree that in the case of failed 2FA (total failure), an alert should be sent to the user: "password used to access account; but second factor authentication was unsuccessful; change password if this was not you".