The phone 2fa app asks you to verify the action, and you input your PIN. My banks hardware token also needs a PIN before it generates a one-time code. Some ba

The phone 2fa app asks you to verify the action, and you input your PIN. My banks hardware token also needs a PIN before it generates a one-time code. Some bank tokens just give you the code when you press a button, though. Those, you have to worry if stolen.