If that were true, why didn’t they do this kind of authentication right from the start?

There is little upside in screwing over millions of existing customers.