Understood, but:

So, when one train operator asked for a photocopy of a passport, he convinced it instead to accept a postmarked envelope addressed to the "victim".

A postmarked envelope? This is baffling to me.

The art of social engineering. The person doing this was a dab-hand at it or else they would not have done what they did.

You can have a plausible excuse for not having your passport - left at parent's house or accidentally in storage.

Driver's license - "I am a cyclist!"

Electricity bill - "My housemate pays all the bills!"

Bank statement - "I only do online banking!"

Electoral roll? - "Don't vote!"

But HR sent me a letter about an update to the company pension plan - will that do?

Yes! - sends through postmarked envelope picture. By that stage the confidence trick has succeeded so 'we know the guy and he is legit'.

You can get this far to get a mobile phone contract which counts as good as a utility bill in terms of supplementary proof of ID. This can then be used to get a deposit only bank account for 'savings'. This can then be just about enough ID to have almost created a person!!!

But with GDPR social engineering you can have it all so much easier.

There was so much panic about GDPR and purging every decent contact from the company newsletter list that no company thought through a thing about how to deal with GDPR information requests. Hubris at its finest.

That should not lead to an "open by default" policy.

Maybe European regulators should have considered that before writing this law.

They did by writing the eIDAS regulation.