I think it works true spoofing blockchain. If you don't have a 2 factor login they have full access.