login functionality can create compliance issue

hi

to run an eCommerce website sometimes requires quite a few things among them is iso compliance for India. now we want users must receive an OTP for the registered mobile number before allocation of the session. but if we are using your plugin it won’t matter that user had verified the login or not they just simply get the session allocation in wp. so how can we add extra steps after successful password and user name validation during login eg. mobile number validation?

the best example is the onlinesbi.com login process or amazon.in the login process.