Part of the problem for me is that it was not clear what usernames/passwords you are supposed to "verify".

If I call my bank, they ask me to "verify" personal, non-secret information. However, they don't actually read it out to me. They expect me to know it for some reason. Not sure what happens if that information changes and I say something they don't expect