People hopefully won’t reuse the username/password they use on GOOD to log into BAD, so the login that BAD does in step 3 will fail.

Some percent of people will reuse their password. This is all but guaranteed.

There is no password. That's the point.

It's just an email, and a six digit code they text you.