added validation for password/pin if last four of phone number are not used