>> "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a

>> "Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required." So all an attacker needs to do is get access to your home or work computer...