I realised this not long after signing up with them. They don't even have a separate 'phone password', the one they ask for (and sometimes read back) is used for DPA as well as email (gmail based) login.