As the sibling comment says, the number is not authentication, it's just an identifier. That type of fraud works exactly the same way as sending a letter to the

As the sibling comment says, the number is not authentication, it's just an identifier. That type of fraud works exactly the same way as sending a letter to the tax agency in any other country does: trust that people won't be so daring as to write fraudulent letters and sign off on them very often. Obviously it will happen sometimes, but they have processes to deal with fraud.