[pc]

This phishing concern is part of why we decided to use one-time SMS tokens with Checkout -- there's no password to steal.

[talos]

That's good to know -- thanks for clarifying that this is a real security concern.