I know of a bank that it asked for every piece of PPII they have on you for account validation. This allows their phone support folks to have every piece of information to steal your identity.