Maybe using Oracle Access Manager. (OAM) I mean by integrating Access Manager with your Forms & Reports and then using the capabilities of OAM, you can configure multi-factor authentication for your Forms and Reports deployment.
I never did that, but seems like It may work..
the references:
https://docs.oracle.com/middleware/12213/formsandreports/deploy-forms/using-forms-services-oracle-access-manager.htmhttps://docs.oracle.com/en/middleware/idm/access-manager/12.2.1.4/aiaag/configuring-totp-based-multi-factor-authentication-oam.htmlOther than that, you may do it by customizing the login.. (but such a customization may bring support issues..)