[someotherperson]

> This type of security theater can be easily bypassed by any determined attacker and thus only serves to deter honest users.

To play devil's advocate, the large amount of attackers aren't really determined. They're just fishing for easy targets. If you check the logs on a VPS you'll see an endless stream of people trying to exploit things like Wordpress 24/7 on your brand new VPS that has nothing but a html landing page.

With banks, I imagine they have a compliance check list they have to tick off to make sure that -- if and when a successful attack happens -- their insurance would pay out. If they haven't taken simple steps like blocking VPNs it could lead to the insurance company claiming negligence.

[ignoramous]

> To play devil's advocate, the large amount of attackers aren't really determined. They're just fishing for easy targets.

The rise of the copy-paste attacker: https://en.wikipedia.org/wiki/Script_kiddie