Rather, my point was that, after solving the purported problem (the fraudulent transaction), moving on to enable some unspecified "security enhancement" was unn

Rather, my point was that, after solving the purported problem (the fraudulent transaction), moving on to enable some unspecified "security enhancement" was unnecessary and should have been suspect. Of course, there's no telling how someone would react in the heat of the moment.