It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.