An appsec anti-pattern I absolutely hate is asking users to turn over their financial credentials to "verify" account ownership, such as adding a bank account (think @Plaid and @Yodlee). This habituates users to give away their credentials, NOT something we want to teach them.

So I refuse to do it. Most of the time, there's an alterative flow where it's validated using small deposits, but it takes a few days. Except @TradeStation, they make you fill out a paper form. After two weeks and 4 submissions, I still haven't linked my bank account.

I'm not sure if @TradeStation product team is purposely trying to make the friction so high that I'll give in and hand over my banking credentials, or if they just don't care, but the experience has been entirely a negative one.