One scam app even captures your QR codes. You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.

That extra 2FA code is typically provided by an app on your phone, and a lot of us rely on Google Authenticator for Android and iOS. The app is simple and straightforward, comes from a well-known ...