Yes, I’ve noticed this is now standard practice for all of my recent calls in the last week or so. Previously, it was only required when I was calling from a number that was not on file, or when I was affecting a reservation other than my own. I suspect they’ve had a rash of incidents where the outbound number was spoofed (which is, of course, very easy to do) and no longer trust that data point.

Delta doesn’t currently have the concept of a phone PIN. They probably should, and maybe they are even working on one as a result of a recent spike in account security issues while they implemented this policy as a stopgap measure...

Birth date isn’t ideal, but it’s the one thing they already have on file that wouldn’t be immediately obvious to a hacker who had compromised someone’s email account. It’s not going to stop everyone, but it’s marginally better than useless as a first pass filter. I’m not sure there’s anything else they /can/ use without starting a new effort to collect additional information from customers.

Since this appears to be a new blanket policy, your best bet is probably to raise your valid concerns about the policy effectiveness with the customer care team, while still providing the information to front line agents who are just trying to do their job.