Proper 2FA demands two different kinds of verification activities