> how can it know it’s doing that for me and not for someone claiming to be me?

By emailing you a OTP :)