Sure, the logic lines up. I think it’s dumb just because how un-useful it is. Waiting for a week for a password reset to arrive in the mailbox is pretty painful.

Pretty secure I suppose, except in the OP’s case, where it was sent to an old address. And they wouldn’t update it over the phone? So they essentially gave some strangers access to his bank account.