[merb]

only works with email validation. Sadly some providers don’t do this (not even Microsoft azure ad in some cases…)

[dotancohen]

Some OAuth users, e.g. from Facebook, don't even have an email address associated with the account. Just a phone number.