This is the part most platforms get backwards. They take the idea first and worry about the account later, because they want the signup to be frictionless.

But think about what we're actually asking someone to do in about four minutes' time: tell us the thing they've been carrying around and haven't told anyone. Nobody does that in a room they don't trust. They give you the safe version — the tidy one, with the interesting parts sanded off.

So the lock goes on first, and it has to feel like their lock, not ours. That's why we hand them a key their own app generates rather than a code we email them. It has to be on their platform, not on someone else's. Establish that, and then they'll open up.

It also does a second job: the setup teaches while it protects. Three short explanations — why email is the master key, why reuse is the real risk, why an app beats a text message — and they leave knowing three things they didn't know, having been taught nothing.