What is a common mistake when working with multi-factor authentication?

A common mistake with multi-factor authentication is strong MFA can be undermined if account recovery relies only on easily compromised email, SMS, or knowledge questions without equivalent protection. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.