Password plus 6-digit authenticator code.
Both factors are required. Failed attempts per IP are capped.