Why would a FFN be worth protecting? They are usually just consecutive numbers and many orders of magnitude easier to guess than a (properly chosen) password. And usually, you can use a user name or email address as an alternative to the FFN, both of which are typically trivial to guess or social engineer as well.