Like Openside said. 6 digits that change every 30 seconds to a minute that transmit to and are associated with your specific account and must be entered with your PW as well. I know that some people also change their static password every week or month in addition to using the RSA key. You really can't ever be too careful on the internet with money tbh.