So how did they know you were you?

They allowed you to update the signature. They may have been oddly fixated on the signatures matching, but they still verified your identity in some other way.

Or they’re idiots who shouldn’t be in control of other people’s money,