A few years ago I ran into a problem logging into a bank website, and one of the things they wanted from me to verify my credentials was (literally, I'm truly not making this up) the reference number on a *letter* they had sent me 6 (six) years prior.
Ah, good, they don't have a mobile number on file, so the bit where they send me the verification code to update my mobile number, they cannot do. So I can't update my mobile number.
It's almost like nobody ever considered this mode of failure, ever.
FWIW I *have* passed security, and they believe I am who I say I am. So.... (giant shrug)