I think there should be 2fa to protect the account