A six-digit code meant to protect you can do the opposite in seconds, once it’s shared, the system assumes it was always you.