Holy crap, really? I've been drawing up [profiles for the user account systems of a bunch of websites for the past few years][1], and I think I've only seen that once before (on a Washington State website, no less).

[1]: https://github.com/opws/domainprofiles

Fairly common pattern on non-tech-oriented sites, in my experience.

The downside of mobile first or mobile only for that matter. Normal web flows are downplayed. Not that this is excusable for a company of this size.

There is no logged-in access to password reset in the (android) mobile app either.