deny access if phone number empty
everything hashed with SHA256
salts PINs, refactoring