What's more comical is that they still as you your zip and last four of your social as a security check...as if those are private and unknown to anyone else. 

 Security theater. Serve the regulators, not their customers. 

 Must be. 

Banking is one of the least secure industries.

It's harder to hack my GitHub account than my bank. 

 But, how? “Safety and soundness” is their guiding motto. 😆