So make a toggle in the account settings that requires a blessed phone or an authenticated visit to the branch to set. There's nothing here that requires _my_ device to be authenticated in order to protect my grandma.