If its the same implementation I am familiar with, its to proffer something unique to the user that they are familiar with that a phisher would likely not have,

If its the same implementation I am familiar with, its to proffer something unique to the user that they are familiar with that a phisher would likely not have, though of course, they could make a request to the provider as you as soon as you offer your username lol.