True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine &

True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.