Perhaps I can make just one quick comment.
If you look at identity theft, typically the solution is always “Give me more of your information so I can make sure it's you”, which just creates more leaks, which just increases the risk that the information will flow and be used against you.
So to call it a “security” measure is kind of funny.