I thought the same thing about #1 until I read this: https://security.stackexchange.com/questions/214814/why-can-i-log-in-to-my-facebook-account-with-a-misspell

I thought the same thing about #1 until I read this: https://security.stackexchange.com/questions/214814/why-can-i-log-in-to-my-facebook-account-with-a-misspelled-email-password?utm_source=Iterable&utm_medium=email&utm_campaign=the-overflow-newsletter&utm_content=10-02-19 https://security.stackexchange.com/questions/214814/why-can-... Perhaps/hopefully the same thing is being done with Schwab. (As you can see from the URL, I got that link from the overflow newsletter.)