This is the same thought process behind 2fa. (And to externalize Google’s spam problem).