> Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads [..] Just today I was trying to pay my car ins

> Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads [..] Just today I was trying to pay my car insurance online via a local payments gateway. After two 2FA sms authentication, one for the insurance one for the gateway, I am presented with yet another 2fa (?) screen on the gateways website to give my password for my online banking account. They, the third party gateway, were kind enough to show me the last 3 digits of my banking username, just in case I forgot who I am during the process. So I call my bank to let them know, "guys wtf is going on, they're asking for my password", to which they reply "oh don't worry, that's fine, that's how we do verification now, nobody will see your password". :0