Two-factor available via authenticator app or SMS, easy to find in account settings and takes two minutes to activate — worth setting up on day one before anything else. Basic password alone is never enough on a real money platform