Also, if they were told to get one it would be trivial to change your login code to siphon off valid logins to another database somewhere.