You can lock down the code and still lose the identity.
If a platform can hand over the passport, the selfie, or the history because an email looked official, the user was never in control of the disclosure.
That’s not a verification problem.
That’s an identity-control problem.