This does not affect the collecting website's security or revenue in any way. They don't care.
They don't do this for their own security. They do it because they're required to. And the requirement is idiotic, which is why the result is... idiocy.
They don't do this for their own security. They do it because they're required to. And the requirement is idiotic, which is why the result is... idiocy.
I've worked in this field specifically for most of the last 7 years. It's a problem on the order of tens to hundreds of millions of dollars annually if you get it wrong.