Implement Enhanced / Two-Factor Authentication

    • Additional secret word/icon
    • Additional code provided by SMS or email — but beware that an attacker will likely have access to both on a stolen device
    • Security questions and answers, selected by the user in advance (e.g. during registration)