Most of these policies boil down to regulations or compliance. The financial industry, ironically, is a huge propagator of antiquated security controls.

We all knew that the controls were bad, but we had to use them