I've logged into a website account and used an authenticator app for the first time today. AIBU to think that this doesn't actually add an extra layer of security?
You log in with your usual username and password. Then use the authenticator app on your phone to scan a QR code, which generates a verification code.
But surely anyone who had gained access to my username and password could have done the same thing with their mobile phone using any authenticator app?
There is no link between my mobile number and the website account.
Think I must be missing something?