If the data is important enough, e.g. bank accounts, there needs to be a backup to 2FA that is relatively painful - to make it resistant to attack - but not imp

If the data is important enough, e.g. bank accounts, there needs to be a backup to 2FA that is relatively painful - to make it resistant to attack - but not impossible.