Also, force passwords to expire. Every 30 days, when the customer logs in, they are alerted that it's time to enter a new password. And for any transaction beyond a certain limit, or to add a new account, the online part of the application or transfer process must be followed by a phone call. These are answers that don't break, don't change, and with which a five-year-old can't tamper, but could understand.

HSBC's service has been invaluable to the Grouch personally, but a clunky solution to a serious problem doesn't develop good security habits in customers, and doesn't lighten the security load for anyone but the bank itself.

Steven Schwankert is a former editor of Computerworld Hong Kong, based in Beijing. He can be reached at tvg@thevillagegrouch.com