Another nonsensical authentication scheme. Why do fund agencies resort to this scheme. Surely this is broken