How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an

How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an email with a quickly expiring link that you click on to view a page where you enter the name of the org or person you /think/ is checking your data, and if it matches things work.