2FA and MFA are terms that encapsulate a few different-but-similar methods: That "second factor" could be a phone, an email address, an app, a hardware key, etc. Just requiring evidence of "something you have, something you know", etc. mitigates so much of what a simple username/password utterly...