ATT has already added the requirement that all accounts need a password and a 4 digit passcode to use the app, access the account online, get information over the phone or make changes to the account in the store.
You should have received notice to change your 4 digit code from the last 4 of your social security to a hard to guess number.