A little bit more research on emudhra.com and DSC

Getting a DSC hardly costs 1500 INR so I thought of using emudhra.com. I opted for PAN based verification. I entered the same phone number and the same email address associated with my PAN, entered my PAN and details. I got a message that phone number is already in use. So how did a digital security issuer not even think about OTP theft and did not validate details with IncomeTax department?

Looks like there are a lot of loopholes being misused.