It's a calculated risk. They know the VIN number and I assume made a copy of your photo ID.