But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym? Also how would they defend against fake IDs? If the p

But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym? Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.