Sure, banks are secure with so little info. What about amazon? Smaller retailers? How much info do you need to reset an email account? A cloud storage account? I wonder, if you're persuasive enough, how many tech supports can you call and get more information to use for more secure systems further down the line?

The fact is, it has been done before and the whole process was detailed. All it took was a couple of security flaws, which the organizations involved promised they would iron out. But what about less prominent organizations? Yes, you're right that if they allow this kind of things to happen, it's their fault.

But then you could say something like, if they allow X with just Y pieces of information (obtained by social engineering), it's <other entities'>. Add on to Y and change X as needed, and you're starting to make a real good profile.

Then, one might ask, well, who gives a fuck? You're not that special, your life is meaningless to people other than you! Maybe. But there are identity thieves out there who would and could use this information. Someone could compile a set of this data, sell it. Or they could gather as much data about people as they can, and threaten to use or sell this information to even more unscrupulous individuals.

What could they do? Likely not permanent or lasting damage, if one isn't that closely connected to their online identities. Or they could use your identity to get to your friends and maybe that family member who doesn't know very much about this computer stuff. Persuade them to surrender their apple or Facebook or Google identity. Use that, do the same thing again, obtain profile. Cause minor financial damage, move on to the next person. Or some of the other messed up stuff one can do with identity theft that I'm too fuzzed up to think about cause I just woke up