Multi-factor authentication to prevent phishing attacks