Ask the person for their one-time code. Every lookup is logged and shown to them — this protects both sides.