>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through t

>For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. This defeats the purpose of using 2FA: to require a second factor every time you login. This completely negates the benefits of 2FA if a hacker has gotten my username/password through a keylogger. It's easy enough to get a good score if you just disable tracking protections and login to a Google account, then a hacker can easily break into your account. I was thinking it had to be the author not understanding how 2FA worked, but Google is actually advocating this ([0]): > login With low scores, require 2-factor-authentication or email verification to prevent credential stuffing attacks. You would think the people behind recaptcha would understand how 2FA is supposed to work. [0]: https://developers.google.com/recaptcha/docs/v3#score https://developers.google.com/recaptcha/docs/v3#score