Customer asked us to print the full SSN on a pay stub for use with ID.ME. We mask the SSN on the stub, per CA regulations, per common sense, and since no state (which is where the stub regulations come from) requires the full SSN. It is normal, but still shocking, a stub, which anyone can "create" on their own, or via app, can be any sort of identification for any purpose. The one exception I could even envision is TX, where the stubs are supposed to be signed by the employer.
ID is more subjected than some realize.
Example, for my software downloads, we obtain and use a "code signing" certificate, to avoid the "unknown/possible dangerous" app warnings. There is a simple (cheaper) option where it is likely only automated identity verification is performed, such as looking at a business name in the DUN database, and access to the designated email. There is an "extended" verification which is supposed to be more thorough. I suspect it is still automated, as it did not require anything further from me than the regular method. The difference is for the signing process, I now have to use a secure USB stick, which contains my "key". The theory is I have to know who I am, the password, AND have the secure stick, to be able to sign my file. Granted, the stick means no one can copy my signing certificate, but it can still be lost or stolen.
The whole identity "thing" is interesting to play with. When I have to give ID, sometimes I use my BIA ID or my passport card, just to see what the person looking at my ID says. Until my next BD, my state DL is still the "old" style, not a real ID, nor does it say not federally accepted. This puzzles some as they expect one or the other to be noted in the upper right.
IN any case, the ID.ME process is another case proving privacy is a fallacy.