If 3 login attempts invalidate the OTP then you only need a manageable number of different "known modifications" to tell the user through the secure channel to

If 3 login attempts invalidate the OTP then you only need a manageable number of different "known modifications" to tell the user through the secure channel to keep this safe. If they can arbitrary brute force you OTP anyway then the OTP isn't really going to be all that useful at 10k possibilities. That said, hardly any user would be willing to take on such complexity without very strong reason.