Only set a second factor record if it looks like one may be used