[singleshot_]

I mean, it feels like stealing but it would be complicated to build a case around a fraud charge given that no one ever actively told a lie.

Maybe this is taken care of in the user agreement or the terms of services? “User warrants that he is not trying to profit by use of the two factor auth system?” I’ve never read an agreement like this one.