Important thing here: each id number has an address. I.e if you call them and say you are Bob with id 123456789 then they know the street address. So they can send a confirmation letter that needs to be signed, to the address belonging to Bob with id 123456789.

This makes the phone scam a lot more involved because you can impersonate someone on the phone but the mail makes it kind of 2fa. The credit card you tried to open in Bob's name will always be sent to the real address of Bob.

The bank didn't need to store much here - names and addresses they can lookup directly from the id number.