Every time a new ridiculous thing. Now the App wants a picture as security verification? How about moving away from phone numbers as main identification? And what about email verification links,that have to be opened on the device with the App? Or is data collection the main purpose here? There are established methods of multifactor authentication, please use them instead of your homebrew solution with questionable privacy security and terrible functionality and compatibility.