Agent can still "forgot password" on many accounts. Or magic link.