[jtdowney]

PayPal was very early in the 2FA movement, hardware security keys were available starting in ~2008 (https://systembash.com/using-the-paypal-verisign-security-ke...). If you're referring to app based TOTP that is a relatively new option.

I was prompted to change to TOTP when I logged in.