Every gaming platform will give the information upon "emergency request," and most CSR's, siding in caution, will happily give out the name, mailing address...email, and even challenge questions...

It's a social engineering attack that has worked 2ezily since 2007.

Similar to SWATting, but essentially in reverse.

Also abusable are the new GDPR requests. Compliance is pretty much at odds with security of the account itself. Complying with the inane EU rules basically makes your system at risk at trivial account takeover, which juxtapositionally/ironically then make it easier to leverage a person.

It's like 2FA over SMS....you are basically at the mercy of a Verizon/ATT employee.

Stop trusting humans, make systems that humans cannot make unilateral decisions without a reasonable amount of redtape.