The core problem is people. The most secure systems in the world are useless if someone carelessly tells someone over the phone or a lunch date the password or challenge questions tied to some account.