Bank of America's online security is outdated. The second factor of identification is a text message. This has been discouraged for many years. They do not offer use of an authenticator. They may offer Yubikey, but if so they hide that choice. SQRL, from GRC is also not available. They also discontinued ShopSafe, which was the ability to create single-use snd single-merchant credit cards. If you are new to Bank of America, I'd look for another bank before you get too involved.