Two-factor, done properly

Two-factor verification is the single cheapest protection on the account, and the version you choose decides how much it is worth. An email token is the weakest form, because a compromised inbox hands the attacker the code along with the login. An authenticator app is stronger, because the code is generated on a device only you hold.

The setup takes about ten minutes. Install an authenticator app, scan the QR the account shows, and enter the six-digit code it produces to confirm. From then on the app is the second half of every login, and losing your phone is a bigger event than losing a password. Write the recovery secret somewhere safe and boring, because that is the one that resets the whole thing.

Do this before your first deposit, not after, because the account is most exposed in the weeks before you have built a habit around it.