[serve_yay]

Yes, they should do that. And I can't think of anything more annoying than needing to receive a text, just so I can log into dumb old Facebook. (I realize there are other "factors" available but that's not really the point.)

[evanspa]

Or, they could do it lazily. I.e., only force the 2FA at the time of money send / receive.