It seems like they're rolling out the equivalent of Application Specific Passwords that Google has for sites that don't work with TFA.

How much info are you displaying on the various merchants that are billing via the individual card numbers? My credit card bill tends to have a transaction identifier, the name of the merchant & a reference number (along with transaction date & post date). Would be great to have merchant's address and additional information on it and flag if it's recurrent.