How do I know someone didn’t just steal someone’s username and password? I assume I should be asking for personally identifying information such as a password o

How do I know someone didn’t just steal someone’s username and password? I assume I should be asking for personally identifying information such as a password or ID? There is some irony here.