How can an authenticator app protect the second factor if a user's smartphone is lost or stolen?

An authenticator app protects the second factor on a lost or stolen smartphone by requiring a PIN or biometric authentication (like a fingerprint or face scan) before displaying the one-time password (OTP). This prevents an unauthorized person who finds the phone from immediately accessing the OTPs. Requiring an administrator password to reactivate after an interval or reboot is not a standard security feature for protecting the second factor itself; it's more related to device management. Location verification is a separate security measure, not directly protecting the second factor on the device itself from unauthorized access.