Professionals should allow 2FA shortly after registration to minimize the risk of unauthorised availability