They certainly could, but there's usually a bit of extra authentication with some of these third parties. For example, they usually request a phone number.