Two-factor authentication

Two-factor authentication (2FA) adds a second step -- a 6-digit code from an authenticator app -- on top of your password, and is required for larger withdrawals regardless of whether it's enabled for sign-in.

Enable it from the Account page: scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.), then confirm with the code it generates. You'll be shown a set of one-time recovery codes -- store them somewhere safe, since each works exactly once if you ever lose access to your authenticator app, and they aren't shown again after that.