True, but whether or not it should be or not doesn't change the fact that it is the current state of the US.

And it's not really just the phone number, but the combination of personal info that allows for social engineering - without having the existing customer confirm the transfer.