Even 2FA as commonly implemented is kind of a bullshit solution (it's once per 30 days, it's not on every transaction, it's not specific to the transaction, the

Even 2FA as commonly implemented is kind of a bullshit solution (it's once per 30 days, it's not on every transaction, it's not specific to the transaction, there's no enduring log, no concept of segregating various types of action, no concept of callback auth/validation, often not multiuser/shared credentials, etc.) Consumer-style 2FA protects somewhat against brute force, against password reuse by users who just don't care, and against theft of a whole password list. It doesn't actually protect the protected resource very much.