I agree what you say, the company that receives the KYC should be careful to check the incoming identity data, because if it is still like that, it is unfair to the person sending the real data.