Not defending this, and it's far from ideal, but also credit card details were already pretty much confirming identities already.