Login and high-risk actions require a one-time code in addition to your password, so a leaked password alone cannot move your money.

• A one-time code is required in addition to your password at login.
• High-risk actions can require a fresh code even mid-session.
• A leaked password alone is never enough to access your account.