Ouch. That indeed sounds terribly insecure. It saddens me that any organization handling money (or any kind of user authentication) does it this way. It relies

Ouch. That indeed sounds terribly insecure. It saddens me that any organization handling money (or any kind of user authentication) does it this way. It relies 100% on "client-side" security. Even 15 years ago these kinds of things were exploited. I was thinking in terms of the Paypal API, they send an independent request from their server to your website.