Staff authentication only: Admin ID or registered admin email → password → MFA (enrolled second factor). Customer mobile OTP will not work here. Privileged ops require MFA enrollment when MFA encryption is configured.