Requiring at least one additional proof of identity beyond the password: an app code, a biometric check, a text code confirmed on the provider's website, a hardware key, or a PIN. Custody of the extra factor matters as much as having it. Strategic Web Management Ch. 2 (2.5)