Feels like one of those "ideas that sounded good in the conference room" that turns out to have unintended consequences.

Hopefully they can fix this and have an effective way to verify identity... or else just give it up and go back to the old, creaky, somewhat effective method since people are used to it.

It sounds like an ok idea that someone didn't execute properly, unless the idea really was to give the checkmark without real validation.