I'm not familiar with offering loans and accepting accounts as collateral, but would it be normal practice to take control of the staked address of the account they are getting as collateral for a loan?  I thought it was normally just the account login information provided?