Re: The problem with entirely online companies....
Why could they not do one of the following:
Ask for the 2FA code
Call him back on his registered phone number
Ask for the last x Pay Pal transaction
Ask for his last login time/date
Mark his account as supervisor changes only with extra verification required
Basically things that aren't public record.