The problem fundamentally is during a sale you don't get access to the actual DB. DD you typically only get a subset of data, so whoever you contact or even physically visit, it all could be fake people answering the phone or even at a fake address impersonating whoever they need to.

For $175m of fraud, it's definitely worth to set that up.

The core problem here is - the US lacks the ability to realtime verify identity against a centrally government controlled DB. US would never allow this under privacy rules, but that's what it would take to really identify a particular person.