Companies not only can, but are actually required, to verify your identity before giving out data. They can just send a template email with the necessary steps to verify it, and only do the work when that is done.