Nutty online banking security stuff

[firecat]

I have a mortgage and I pay it online. When I log into the account, this is what usually happens:

1. They demand that I change my password to something different from what it was before. So I do it. I believe that the strongest passwords include letters, numbers, and symbols. So I enter a password like that. Then they tell me I can't use any symbols. So I have to redo it to something less secure.

I have a program that stores all my passwords now, but before I had that, I had trouble remembering what password I was using for this site (because I constantly had to change it and couldn't use symbols) and I kept having to call them up and get them to reset the account.

2. They demand that I answer a "security question" that I previously set up.

3. When I confirm my payment, they demand that I enter the last 4 digits of my social security number.

This seems ridiculous, especially since a mortgage account ONLY INVOLVES MY GIVING THEM MONEY. I can see reasons for using multi-factor security to protect checking accounts and credit accounts, but I can't think of any reason for someone to hack into a mortgage account.

Comments

[amadi]

This is exactly what I'm thinking. I'm reminded of the trick, if you use GMail, you can do myaddress+variable@gmail.com and whatever it is on the right side of the + is irrelevant toward getting the mail to you, but can be used to track if businesses or organizations are selling/sharing your email and also for labels. But countless places won't allow the + because their programmers couldn't be bothered to escape for any symbols in email addresses beyond . and @

My bank is one such place. It's frustrating. But they give otherwise good service so I stick with them in hopes that they'll eventually hire a better programmer.