I like to share a real world example.
Meet Julie*, she entered her password in what seemed like a login page when clicking a link to see a file, and didn't realise she had been fooled. She found out 4 weeks later when everyone she dealt with started receiving spam messages from her account, and she reported it to IT. They blocked her account and confiscated her devices to be inspected, they discovered all the content that had been accessed while her login was lost, including sensitive content which led the executive director of her area was running a disaster meetings to address the issues and regain confidence of clients. Julie had perhaps the worst day of her career, a blight on her reputation not just within her company, but in everyone of her clients. *Julie not actual name
2 Step verification means that the next Julie can just reject the sign in request and block their account immediately. Its not just company data that's at risk.
