When I run into that problem I wait for the rejection mail from the creditor, then I write back with a redacted photocopy of my IDs - completely useless with everything blacked out but my name - and a copy of their letter. I say here is my redacted ID as proof of identity and a photocopy of your letter as proof of receipt so please approve me and that has worked every time so far. It makes it very easy to see where the line between security and security theater is drawn. Not that any US bank is going to win awards for security (except maybe Robinhood, they really stand out with standards based 2FA and the ability to block external ACH with a click)