This would not be trivial and would require successful phishing. I've sent an email requesting to make this even harder to do. leaving out those details on purpose