But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym?

Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.