What if that all checks out but someone else goes to actually pick up the item? IME it’s reasonable to verify that an identity is legit, but not that the perso

What if that all checks out but someone else goes to actually pick up the item? IME it’s reasonable to verify that an identity is legit, but not that the person providing that identity is the person tied to that identity. And it all goes out the window when they send their boyfriend/assistant/coworker to actually pick up the item.