Identity theft expert says this is the ‘worst’ way to lock down accounts