Since there is some debate on mandatory 2 FA authentication throws in 2 cents.

I'm against it myself and prefer it optional since it's a pain, I keep it off unless it reaches a certain threshold amount where it becomes worth waiting for a text from the tower.

The same thing can be done with PVC's which is banking standard procedure
(personal verification questions)
What school did you attend in Elementary School
What is your favorite toy
What was your first car
That basically is 2FA without the technological depth or reliance of phone integration, so its all about the alternatives, that said think this should have all been discussed in the suggestions thread you guys fufufu