Right, I totally agree with manual override, but then I think it makes more sense to just ask the user how the code was obtained. Like I suggested here: Trust design: perhaps an invite link shouldn't always be trusted (maybe it's a good idea to ask the user?) - #47 by ell1e This is then independent of whether the camera was used or not.