Sure, but the point is the process at the company receiving the request for data should change. They should verify the requesting entity.

Then if the people processing these requests don't follow that process, then that is a different problem. But as it stands now, those people can follow the process to the letter and we still get the wrong outcome.