tears out hair

I don’t think it’s just streaming services. FTC quotes gym memberships as an example as well, and they’re notorious for bad cancellation policies.

Good question. A lot of banks in Europe use this type of setup, where it will ask you for 3-4 characters of your pin/password, both to login and to confirm transactions. I always thought it was weird but never thought about the security implications.