If you don't ask for email validation and you don't implement an API rate limiting many hackers can create a script that will fill your database with random generated users and you won't understand what happened.

This is a simple example that demonstrates why you should and must implement email verification.

More.. you should block the account when a user enters wrong password 5 times during a 2 minutes period for example (you can adjust these numbers). This is also a good security measurement.

Even more.. you shouldn't fake business numbers. Customers and investors will lose their trust in you.