4fa legality us