What are some of the ways this blows back? Having to answer them over the phone when they're not passwords, but more like customer service gatekeepers?

I do this as well and it has yet to blow up in my face, though it does seem like an inevitability.