At what step in the user flow of a travel booking app would 2FA OTP be needed

i'm designing a 2FA OPT feature for an app that lets users book flights and trains. As users are able to store personal information including their payment details, this level of verification is needed.

At 1st it made sense to include this at the beginning, just after users log in, similar to banking apps. However i'm considering including it in just the parts of the app where sensitive information will be accessed. this way it might not be such a hassle for users accessing features on the app what doesn't have personal information. what are your thoughts? are there any other solutions?