To prevent abuse add MFA to the ID. Problem if stolen cards solved and still zero knowledge.