There is also a herd immunity as the bank is highly unlikely to post two lists on their website, one of low security users and another of high security users. So outside attackers have to break the first ring of security before knowing there exists a second ring.