they should have this verification flow in-app. emails seems a bit phishy