Thanks for the feedback and totally understand where you're coming from. We're working on adding these security measures in the near term. We care a lot about security too - one of the reasons we started Brex and made virtual cards a feature is that it is a much more secure payments tool. We started on the acquiring side where fraud is a huge issue and we're looking forward to adding more security features shortly.

If you cared a lot about security, wouldn't you have built the platform on basic security methods like 2fa and hard sign in from the start? Surely patching these in afterwards will leave gaps. Are there other important security precautions coming "in the near term" like encryption at rest?

Is 2fa a norm in the corporate card market?

I've carried a handful of different corporate cards, and do not recall even being offered an option for it.