> Yes. I assure you that when bad guys with your username and password log in and steal all your money the bank _won't_ say: "Doh, our sophisticated environment

> Yes. I assure you that when bad guys with your username and password log in and steal all your money the bank _won't_ say: "Doh, our sophisticated environment, behavioural and heuristic patterns used to establish legitimacy let you down this time. We'll pay for this" No, they'll say it is your fault because the bad guys had your username and password. If your bank treats you this way, you should contact the relevant government authorities. In the US that's the FDIC: https://www.fdic.gov/consumers/questions/consumer/complaint.html https://www.fdic.gov/consumers/questions/consumer/complaint.... In the UK that's the FOS: https://www.financial-ombudsman.org.uk/contact/index.html https://www.financial-ombudsman.org.uk/contact/index.html My own experience is that the bank fixes the account balance while I'm still on the phone with them so I'm not inconvenienced, does an investigation, and then decides whether it was actually me that did the transfer over the next few weeks.