But they know their username and password. Surely that should be enough. It's enough on any other day until your account is suddenly locked.