"Selfie" authentication, or any data gathering, is not legitimate when it comes to unsolicited things. Just because someone knocks on my door with a surprise gift doesn't mean I owe that person anything.