The custom membership provider described above is definitely useful but the implementation of 2FA that I used was https://github.com/RobThree/TwoFactorAuth.Net This comes as a nuget package ^[1] and is really well done!

You will need to write a custom membership provider and find a way of passing multiple credentials to the MembershipProvider, either as an extra parameter or using a new method. Since the MembershipProvider is only created once per app domain, and could process multiple user requests, it is best not to split calls between authenticating the password and the 2nd factor.

The solution I came up with implements an additional interface and the provider is checked for this support when validating the credentials passed back to the server.

First, define an interface that accepts multiple factors (such as a password and OTP)

public interface I2FAMembershipProvider
{
    bool ValidateUser2FA(string username, string firstFactor, string secondFactor);
}

Then implement this additional interface in your existing MembershipProvider

public sealed class SampleProvider: MembershipProvider, I2FAMembershipProvider
{
    //Validate 2FA requests with both factors simultaneously
    public bool ValidateUser2FA(string username, string firstFactor, string secondFactor)
    {
        //... implementation here
    }

    //Traditional single factor authentication
    public override bool ValidateUser(string username, string passcode)
    {
        //... implementation here
    }

Finally, check if the provider supports this interface when validating the credentials when they are posted back to the server:

if (Membership.Provider is I2FAMembershipProvider)
{
    //Validation using enhanced interface
    if (((I2FAMembershipProvider) Membership.Provider).ValidateUser2FA(username, password, passcode))
    {
        FormsAuthentication.RedirectFromLoginPage(username, false);
    }
}
else
{
    //Traditional membership provider validation
    if (Membership.ValidateUser(username, password))
    {
        FormsAuthentication.RedirectFromLoginPage(username, false);
    }
}