This has nothing to do with a debit card. They called int the bank, authenticated using the Experian data, changed my contact info and set up the P2P transfer. How the bank allows all that based on a phone call is beyond me.
Our credit union just updated their online and mobile banking and I had to reauthenticate my account. The identity questions were obscure ones - I'm sure not listed anywhere and I actually hope I remember the answers if I ever have to answer them.
I don't use the automated telephone system so I don't know what options are available. If I speak to a live person, they always ask my last transactions as verification, as well as my social security number.
Change banks if you can.