Yes, but only if the domain holder's information is incorrect and the registrar is therefore unable to verify the domain holder's identity.
If the registrar cannot verify the domain holder's identity and consequently cannot determine whether the person requesting the authorisation code is authorised to do so, the authorisation code must not be provided.