Shouldn't they have checked more than just the last two characters? I thought you're in the clear if you check the first and last six characters.