Have we gotten to the point yet where simple posession or knowledge of personal data is insufficient to prove identity? Seems like we should have been there years ago.