such as unverified email addresses or security questions with public answers