To prevent duplicate accounts, first-time login requires phone number or email verification.