This frequently happens with GDPR data/delete requests. They will ask you to verify all the shadow data they collected about you is indeed correct before giving you a summary or promise to delete it.
All that's there is a name and bank account link, I told them 'I am Oliver Ford' and that I'm happy to provide a secret shared by way of reference attached to a penny transfer to that linked account; but no - I must provide a copy of my passport and proof of address (which they don't know, and I can edit on the site anyway), obviously.
Imo if one can log into an account they should have the right to request a delete/download for all associated data. Considering PII could very much be involved self service would even be better.