Huh, I see. I didn't get the impression he's using SMS. I thought he was just describing the feature Chase offered, not that he was actually using it. I'm not asking about SMS 2FA at all, I'm asking what app-based 2FA itself would protect against. It seems like an extra step that wouldn't really help anything.