A user may sign in with Google and later use a password for the same email. Decide whether these identities represent one account. Safe linking generally requires authenticating the existing account and deliberately linking the second provider, or a carefully reviewed verified-email policy. Never link accounts solely on a user-submitted email address; consider provider subject IDs, verified email status, recovery, and duplicate-email handling.