add a different ID check to the MFA if that doesn't work, then add more MFA to that new ID check. Eventually it has to work, right?

It's definitely worth doing infinite security in order to avoid regulating social network algorithms, because

To prevent abuse add MFA to the ID. Problem if stolen cards solved and still zero knowledge.