A stolen password is not enough when the second key is in your pocket. Turn on 2FA with a QR code, save the backup codes and reject a stranger’s sign-in request.