it depends, a lot of times they just trust that the token is one time use to set up an account that gets added to the group and doesn't check anything