Usually. It's also why some institutions will lock you out entirely without a visit for a photo ID check. Pre-designated people in some high-security settings with optional tokens or biometrics.

Now, some measures you run into will exist because a non-security expert formulated them to cover their ass after reading something online or in a bookstore. Or by security people who also have to comply with a policy or regulation of varying degrees of sanity. So, it's not always a real attack or risk inspiring specific measures but often is for verification during support.