diff --git a/server/routes/study-auth.js b/server/routes/study-auth.js
index 6394317..12104c1 100644
--- a/server/routes/study-auth.js
+++ b/server/routes/study-auth.js
@@ -195,13 +195,14 @@ export function register(app) {
       return
     }
     const user = state.studyUsers.find(u => u.id === userId)
-    if (!user || !user.totpSecret || !user.totpVerified) {
+    const twoFaMethodCheck = user?.twoFaMethod ?? (user?.totpSecret && user?.totpVerified ? 'app' : null)
+    if (!user || !twoFaMethodCheck) {
       res.status(400).json({ message: '2FA is not configured for this account.' })
       return
     }
 
     const codeStr = typeof code === 'string' ? code.replace(/\s/g, '') : ''
-    const twoFaMethod = user.twoFaMethod ?? (user.totpSecret && user.totpVerified ? 'app' : null)
+    const twoFaMethod = twoFaMethodCheck
 
     function completeLogin(extra = {}) {
       user.lastLoginAt = new Date().toISOString()