Not necessarily (as you wouldn't in a store); they'd just never to prove sufficient knowledge of the transaction (e.g. invoice number).

Note for example how you can track any package in the world when you know it's code. That seems to be working well without relying on user authentication, no?