If a fraudster does somehow get your username and password, he will still not be able to access your account because he or she will not have access to your one-time passcode. Thus, he will be unable to complete the login process.