Two-factor authentication via authenticator app is mandatory for any withdrawal above one thousand dollars. Providers that still rely solely on SMS codes subject players to SIM-swap attacks; we therefore disable SMS-only accounts for high-limit users and encourage them to migrate to app-based tokens. Session timeouts happen after fifteen minutes of inactivity, reducing the window during which an unattended browser could be hacked.