Common second factors are TOTP codes from an app, push approvals, SMS codes and FIDO2 security keys or passkeys. Only FIDO2 and passkeys reliably resist phishing, because they are bound to the real domain. SMS is the weakest option because of SIM swapping.
TOTP depends on time: if the clock on the phone or the server drifts by more than about 30 seconds, correct codes are rejected.
In support, the most frequent MFA cases are a lost or new phone without migrated codes, missing recovery codes, and app passwords for old mail clients that do not support MFA. A documented reset process with identity verification saves time here.