One scam app even captures your QR codes.You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.

All you have to do is scan a QR code for the service you want to turn 2FA on for, and the app will generate a new log-in code around every 30 seconds. This week, Google has given its 2FA app ...