The users have to pay for the inability of service providers to provide security. The whole system is flawed of course: Everything is password based in the end. It’s a deep error that I don’t see being fixed anytime soon because it’s been with the systems from the start.