Comment by coffeeblack

If they have password and 2FA on the same device, then it's not 2FA. Tell them to get an external TOTP generator, at least.