> "I was suspicious, but the bank’s systems could easily be a wasteland archipelago of isolated micro-services that used different phone lines." Anecdotally, I

> "I was suspicious, but the bank’s systems could easily be a wasteland archipelago of isolated micro-services that used different phone lines." Anecdotally, I've found that the frustrating thing is that real banks/financial institutions tend to also commit a bunch of super sketchy (security wise) behaviors. I've encountered the following when applying for a credit card issued by a certain four letter bank: Applied for the card online, but instead of getting a card in the mail, got a letter about "suspicious activity" on the card. Mind you, the card had yet to be issued to me and I didn't even know what the # was going to be so the card referred to in this letter may as well have been anything! Since it was my first card with them, I'm thinking "okay they probably mean that they want to re-confirm my ID and just used a weird template". So I call the phone # in the letter, making sure to first confirm that it matched one of the service numbers listed on the bank's website. I get rerouted to a customer service agent after a bunch of automated prompts and the agent tells me they'll need to call me instead of me calling them. Weird, but, OK, maybe they want to confirm my phone number is real. So I hang up and promptly get a callback from a completely unrecognized number that was not listed on the bank's website (and turned up no useful search results). Again, sketchy, but hey maybe they have different outgoing phone lines. The agent is then like "I need to confirm your identity for the credit card. Do you have some checking account with another bank?" Ok, again weird but whatever, so I go "yeah, I have an account with *** bank" "Ok we'll have you verify your account with *** bank". Then proceeds to _forward me a call they've made to the telephone banking service of *** bank_, which prompts me to enter stuff like my user ID and _password_. Knowing how telephones (and authentication systems) work, I'm like "uhh what... no... I'm not comfortable entering anything here because you'd be getting my full login info for this other bank..." and subsequently had to work out a different way of doing the verification. All said and done, they did end up happy with the ID I provided and the card arrived a week or so later. But still, super sketchy interaction throughout... tl;dr: A real bank's credit card dept. essentially tried to MITM my login credentials to another bank's phone banking service as a part of verifying id.