In my experience, they do what they want.
Another anecdotal data point with a different UK bank: Recently an acquaintance has found themselves frequently locked out of their account because (according to their fraud team) someone is failing authentication challenges on the phone. My acquaintance has had to visit a branch multiple times to verify their identity and get passwords changed.
So even though someone can't prove who they are, they're locking my acquaintance out. How's that fair?
The kicker was one phone call where (after having discovered the account was locked... again...) the fraud team on the phone sounded incredulous, asking why we hadn't gone in to branch like they asked "last night"? Less than 30 seconds later they noticed last night's call was marked suspicious... that authentication failed... and that that phone call had triggered the lock the account.
The worst part is that no "human" will take your case on. They read from a script and aren't allowed to empathise. No "I'm really sorry, I can see why you're upset" or even "If what you're saying is true, I wouldn't be happy either."