There's also more than just phone. Could use the full credit card #. They can also send the device a push notification with a security token and have the user reset password with it in lieu of an email based token.