Two-factor sign-in asks for a six-digit code as well as your password. The code changes constantly, so knowing your password is not enough on its own.
Setting it up
With an authenticator app — scan the code shown on screen with your app, then enter the six digits it generates to confirm the pairing.
By email — a six-digit code is sent to your address when you sign in.
The app is the stronger of the two, because an email account is itself protected by a password and is the thing an attacker usually has already.
Backup codes
A set of single-use codes is issued during setup, and they can all be copied at once.
Save them somewhere that is not the phone with the authenticator app on it. Their entire purpose is getting you in when that phone is lost, broken or replaced, and a business owner locked out of their own financial data on a Friday afternoon is a genuinely bad afternoon.
A password manager, or printed and filed with your other business documents, both work. The same device does not.
Why it is worth the extra step
The account holds your bank connections, your customer list and your financial position. A password on its own is one leaked reused credential away from all of it, and reused credentials are how nearly every small-business account compromise actually happens — not through anything sophisticated.
The extra step costs a few seconds a day.
If you are locked out
Use a backup code. If those are gone too, contact support — see getting help. Identity has to be established before access is restored, which takes longer than a backup code and exists for the same reason the code does.