Multi-Factor Authentication (MFA) enhances security by requiring users to confirm their identity using an additional verification method beyond just their password credentials.
MFA is off by default in your organization, and must be enabled by a Financial Administrator. Once enabled, all account users in your organization will be required to use it. In other words, it is an account-wide setting for staff and cannot be set for one user but not for another.
To Enable Multi-Factor Authentication:
Logged in at the Financial Administrator level, go to Account > Users. Just above the list of account users, check the box to enable Multi-Factor Authentication. Note that enabling MFA only affects User Accounts at the staff level, listed on the Users page. This does not affect App or Giving logins for your congregation. 
Using Multi-Factor Authentication:
Once enabled, Account Users will log in with their email and password as usual. Once the login credentials are validated, you will see the following screen:
If your church has a Text-to-Church account and the staff member logging in has a mobile number in their Online Account record (which may differ from the number listed on their member profile), a security code will be sent to that mobile number.
If Text-to-Church is not enabled for your church or the staff member does not have a number in their Online Account page, they should click the "Use Another Method" link so that the security code will be emailed instead.
Optionally, the person logging in may check the box to "remember me for 30 days on this device." Doing so will result in the user needing to provide only their email and password (when using the same device), without the additional MFA step, for 30 days.