Report Offensive Message
The second layer is a picture and phrase you verify
Most of the finacial institutions have a picture you choose and a phrase to go with the picture. This is not to stop people from accessing your account, it is to stop you from providing your log-in credential to a spoofed site. Bottom line, it is still single factor security..."something you know"