Any somewhat decent company would have an alternative, more rigid verification process to rely on when the basic one is insufficient. It doesn't require telling which part their doubts lie with. They do sometimes ask for an official ID, but apart from that...?

Either way their reasoning is flawed. An actual fraudster will simply keep trying and find out themselves, because they have nothing to lose. Therefore it's security through obscurity at best. Meanwhile legitimate customers/prospects suffer.