Shown once. Send the link and the PIN through different channels — one compromised inbox shouldn't carry both.