Another step after password
Many sites stop at passwords; here, entering OTP strengthens the session, making login from a wrong device harder to access.
Using at least 6-digit codes makes mistakes on screen to spot; if you change phones, you must reverify, reducing risk.
