Security and convenience are usually in direct competition with each other. Customer service people have to listen to people yell at them when convenience is sacrificed and aren't held accountable for security problems. They therefore optimize for customer convenience. I don't completely fault them for it. If anyone has had the frustration of sitting on the phone with a customer service rep trying to remember a PIN code that was setup 5 years ago when signing up with an ISP and was never thought about since, you can probably understand it.
It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out).
If I was a security-minded person looking for startup ideas, this is the problem I would be looking to solve.
It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out).
If I was a security-minded person looking for startup ideas, this is the problem I would be looking to solve.