zkKYC query

Apologies for the random query, but I wasn’t entirely sure as to the subreddit I should be asking this question on. I have recently come across the concept of zkProofs, and wanted to understand this further.

In a situation where a zkKYC token is issued by which somebody can verify their identities with an institution (i.e. a bank), what stops them from giving the key holding that token to another, facilitating, say, a fraudulent loan application. I understand that the token facilitates confirmation that the required details are correct to complete the loan application, but what would stop them fraudulently providing the key to another?