Originally Posted by Qwkynuf

My bank accomplishes this with a security phrase. This is much easier to change/update than my birthdate and street address, after being required to repeat it out loud where the potential for someone to overhear is non-zero.

I have the same problem with the relatively recent similar change on Twitter. I have been required to provide my full name, SkyMiles number, and street address before the Twitter team would apply a regional upgrade certificate for me. Before this year, they were able to see that my twitter username was linked to my SkyMiles account, and that was good enough. They have told me that the change was to "improve security". I have 2 problems with that - 1) Shoulder surfing is a thing, and I am almost always in either an airport, a lounge, or on an airplane (on wifi) when I use Twitter rather than calling, which means that I am surrounded by strangers. 2) If they are using that for verification due to concerns that my Twitter account might be compromised... if that happened, all the "bad actor" would have to do is scroll back through my DMs to find the information. 3) Am I the only one who visualizes Nicolas Cage when I hear the term "bad actor"?