Comment by LinuxBender

This would not be trivial and would require successful phishing. I've sent an email requesting to make this even harder to do. leaving out those details on purpose