As businesses continue to integrate sophisticated identity verification systems, the temptation to collect as much user data as possible grows. Unfortunately, this approach backfires. Storing excessive amounts of personal data, particularly in onboarding and KYC (Know Your Customer) flows, does not automatically lead to enhanced security. Instead, it expands the surface area for vulnerabilities and increases the potential scale of impact of security incidents.