So any bad actor can launch a phishing campaign without even being tied to an account? Or did I misread?