Why we ask
Your books contain every figure about your business. Two things protect them: a sign-in code only you know, and an authenticator app on your phone. An email address on its own is not enough, because anyone who reaches your mailbox would otherwise reach your accounts.
1. A sign-in code not set
Something only you know. Not your business name, your web address or anything printed on your letterhead. Those are the first things anyone would try.
2. An authenticator app not set
Google Authenticator, 1Password or Authy will all do. Scan the square with your phone's camera, then type the six digits it shows.
Cannot scan it? Type this key into the app instead: