SSN and knowledge based auth are sometimes sufficient depending on where you fall against the company's risk model.

KYC processes are a type of situation where it is not a good idea to extrapolate all people's experience from one person's. The underlying mechanisms intentionally vary from person to person.