[ptman]

Not credit card. Bank account. Webauthn/passkeys could also work for auth as they check the domain and can't be phished