Why not just send that OTP to their phone immediately if someone has trouble logging in?