Here's my 2 cents.
You can gamify via achievements, rewards, or comparing to others (leaderboards) (there's of course endless other ways but these are the most common broad categories).
In a security system I wouldn't compare users security to others, being on the bottom of said leaderboard means you have low security, thus you become a target.
If you can offer rewards for being more secure then that will obviously encourage users to participate. This can be rewards like "Great you've enabled two-step authentication, by helping us save money on fraud-protection you've qualified for $X of your subscription fee!". Or since you mentioned the users are being held liable you can phrase that as the reward "Woo! You enabled SMS authentication, your fraudulent-charge liability deductible has decreased by 5%!" (obviously I'm just making words up).
Achievments - Finally, if you can't give out tangible rewards you can make up rewards in the form of achievements. This will be less enticing than actually receiving a reward but getting the curiosity of "what are these badges" "what will I get" should be enough to get more engagement. Flash up a little badge icon that says "You're password has 200bits of entropy, you've unlocked the Bank Vault Badge, unlock more badges by ..."