But that does seem stupid. Since it’s something everyone has, I think he has a pretty decent idea there.
Even a passport # or DL # is dangerous if it's on the web.