Short answer: treat login methods as recoverable credentials, not disposable profile fields. A multi-identity account page should only remove a method after proving the user still has a recovery path, step-up authenticating for the action, and revoking every session that could keep the old identity alive. In a fintech product, that sequence matters more than a polished unlink button: an accidental lockout becomes a support event, while a stale session can become a privacy incident.
The decision table I use before touching an identity
Start with a server-side inventory. The page may show Google, passkey, email, phone, or an enterprise subject, but the API owns the facts: when each method was verified, when it was last used, and whether it is the final recovery route.
Account state
Remove action
