Years ago I found a glaring security hole in schwab where when imputing a security question answer, if you got it wrong you could just hit the back button and try again.

to their credit, they took me seriously and I believe they fixed it reasonably promptly.