The algorithm trusted its memory of her more than the person herself.
And where screens fail, voices take over.
David hits his breaking point when his bank cancels a $6 corner-store purchase and calls him back “for his protection.” There’s a click, then a voice trying to pronounce his name.
“Hello sir, am I speaking with… Day-veed… Dee-veed… Deevid Jons?”
The line is thin. The script is rigid. The agent tries again, each repetition faster, more anxious, as if clarity itself might get him flagged. Call-center workers are trained to flatten their accents into a “neutral global voice” that isn’t theirs³. Many describe feeling erased, blamed, or exhausted by the emotional labor of apologizing for decisions made far upstream in systems they never touch⁴.
If the maze is impossible, the guide will always be mistaken for the villain.
The identity questions become surreal. Which of these addresses have you never lived at? What year did you take out an auto loan? What color was your first car?
But the system feeds the agent American street names that twist into phonetic puzzles; Midwestern brand names collapse into static as he tries to interpret them. When he reaches David’s high-school landline—a number abandoned before the iPhone existed—David closes his eyes. Both men are trapped: one with the authority but none of the context; the other with the context but none of the authority.
Meanwhile, streaming platforms wage their own border dispute. Netflix, tightening password rules, now flags devices that can’t be matched to a home network⁵. Travelers, students, seasonal workers—collateral damage in a digital residency dispute. VPN detectors misfire, assuming anyone near a crowded cell tower must be tunneling through another country⁶. Silicon Valley calls these “edge cases.” Normal people call them ruined evenings.
Security experts know this is unsustainable. Attackers now rely on annoyance itself—flooding victims with approval prompts until they tap “yes” just to stop the buzzing. It’s called MFA fatigue⁷. Friction becomes the vulnerability.
There’s a better way. Passkeys remove passwords entirely, using cryptographic keys tied to the devices people already hold—already deployed by Apple, Google, Microsoft, and dozens of major platforms⁸. Risk-based authentication watches quietly in the background and intervenes only when something looks genuinely wrong⁹—often outperforming human-interrogation systems at scale. Continuous authentication learns your patterns and alerts only when the device stops behaving like you¹⁰.
And it works. The obstacle isn’t technical—it’s cultural. Friction is cheaper than redesign.
Banks would have to admit that a Malaysian agent reading a question he doesn’t understand over a jittery line isn’t security—it’s ceremony.