It is weird that we accept that "knowing person A's date of birth and mother's maiden name" is remotely acceptable as a proxy for "being person A"; similar to the weird US bank custom of accepting "knowing the account number and name associated with an account" as a proxy for "is authorized to withdraw money from the account"...