[heathermiller]

Given the number of people that have their fb accounts hacked every day, I'd be pretty concerned about giving Facebook my credit card info too.

[cwilson]

If I were Facebook I'd require anyone using the Pay feature to turn on two factor authentication.

[serve_yay]

Yes, they should do that. And I can't think of anything more annoying than needing to receive a text, just so I can log into dumb old Facebook. (I realize there are other "factors" available but that's not really the point.)

[evanspa]

Or, they could do it lazily. I.e., only force the 2FA at the time of money send / receive.