Test a bank login with a second factor

Failure modes in this flow

The interesting assertion is not that the login succeeds. It is that the second factor is genuinely required and that the dashboard behind it masks what it should.

• Credentials alone are not enough - a verification step appears rather than a dashboard.
• The code is required - a one-time code field, asserted before it is filled.
• The dashboard loads - greeting the right customer by name.
• Account numbers are masked - every account shown with only its last four digits.

The masking assertion is the one worth keeping most. A dashboard that renders full account numbers is a data exposure that looks completely normal to anyone who has not checked, and it survives review easily.

Writing the objective

The second step asserts the challenge appeared before any code is entered, which proves the second factor is enforced rather than optional.

---
mode: testing
url: https://my-testing-repo-main.vercel.app/chase-clone-app?reset=true
max_steps: 45
tags: [chase, banking, auth]
---

# Chaise Bank 23.1: Login with 2FA

Catalog objective: log in with an OTP challenge.
Key assertion: the dashboard loads with masked accounts.

## Enter the credentials
Type "priya.nair" into "Username", type "Bank2026!" into "Password", and click "Sign in".

## Verify the second step is required
Verify a two-step verification banner appears with a "One-time code" field.

## Enter the one-time code
Type "483921" into "One-time code" and click "Verify and sign in".

## Verify the dashboard and masked accounts
Verify the dashboard greets Priya and the accounts card shows "Total Checking ••••8841" at "$4,210.55", "Premier Savings ••••2290" at "$18,740.12" and "Chaise Sapphire Card ••••9921" at "$-1,284.37".

The final assertion checks three accounts including a credit card with a negative balance, since a negative figure rendered as a positive one is a display bug with real consequences.

The assertions in detail

Credentials, a challenge, a code and the dashboard.

Asserting a negative balance on the credit card is a small detail that covers sign handling on the account most likely to carry one.

Running it locally

kane-cli testmd run tests/chase/login-2fa_test.md

Add a variant with an incorrect code, since a second factor that accepts a wrong value is the most serious defect this flow can have.

Credentials belong in secret variables rather than in the file. The test.md format covers passing them safely, and running in CI covers sourcing them from pipeline secrets.