

2FA isn’t an option for my income tax portal but would be a safer option.
Aliases are used so I never share my actual email address. If any service I sign up with starts spamming, I know that email has been compromised (probably in a breach) or the service spams their users.
Security is very easy for me. Password managers are the norm among the privacy/security community.
They also have something they call a “2fa grid”. Its a picture they send out once a year to citizens with 12 groups of 3 letters. They ask me to enter the letters from three of the boxes. Not an industry standard method for sure. Signing into the portal is probably the most difficult of all my accounts.