I know this must be a challenging concept for some people, but if you're in the vanishingly small group who
1) want to buy an iThing
2) haven't done so before
3) have some oddities in your order such as details mismatches which means Apple are rightly wary of it being fraudulent, and
4) don't want to prove that you are, in fact, you and that your card isn't being used without your permission (and are also blind to the fact that if Apple didn't do this, you same outraged people would be claiming that Apple are crappy for not verifying orders properly and letting people's cards be fraudulently used
then couldn't you:
5) walk into a shop and physically, you know, buy one? How's that hard?
"and was told by her bank that they had never heard of private companies asking for this information."
Whoever told her that is an idiot, and so's she for believing them. Private companies ask for verification documents all the time, leaving aside the fact that many online retailers will do exactly this for suspicious orders, the likes of solicitors, estate agents, letting agents, investment advisors, banks etc all do exactly the same for everyone that walks through the door (and are all private companies), though more for money-laundering than card fraud reasons.