MS can also call you, then you only have to press # to log in. Makes it even easier for a spoof website.