A lot of people complain about having to maintain secure passwords and other IT security measures, too, but that doesn't invalidate the measures. I'm first to

A lot of people complain about having to maintain secure passwords and other IT security measures, too, but that doesn't invalidate the measures. I'm first to agree that the regulatory burden on banks has gone too far, but all too often, people not seeing the point behind compliance frequently do so for the reasons as above (they don't understand it), and jump to conclusions. If your friends substantiated why they believe so, please do follow up.