I don't have the citation but I recall a researcher who was studying this practice. He suggests that these requests for "factors" will continue to escalate to the point of absurdity. The sales pitch to the user is essentially "The more we know about you, the more we can protect you." However, if the user is seeking protection from others who are trying to discover her personal details, then this continual "full disclosure" to each tech company is counterproductive.

This sort of nonsensical reasoning has also used by individuals portraying themselves as "whitehats" who try to profit from large leaks of personal data. Users are asked to provide personal data to the whitehat in order to confirm whether their personal data has been leaked.