Daimn. We are being super careful with the tokens. In our case, we were making phone calls to verify phone numbers. That was a crucial mistake. Did they get a

Daimn. We are being super careful with the tokens. In our case, we were making phone calls to verify phone numbers. That was a crucial mistake. Did they get access via tokens or email/password?