Add a one-time code protection layer (read: authenticator) if you want maximum protection.