Security Overshare

Customers don't understand what companies require for verification. So they give you more than you could ever need, or want to hear. They will give out their social security number or password or other personal detail to you for no apparent reason, or because they think you might need it at some point. When you're not doing a credit card, it's not needed, so it's really an overshare. Is it any wonder why so much identity theft keeps happening?