Is there a reason to intentionally induce errors in forms?

Question

An interesting thing happened on almost every bank and credit-card website UI I used today: I entered absolutely correct data. And the system updated/refreshed, either through a refresh or some sort of AJAX activity...

... and it intentionally discarded one part of my entry. We're all familiar with credit card sale screens that refresh and discard your card's CVV2 number (that one, I thought, was due to PCI-DSS). Not that, but other things quite similar - often losing data that isn't particularly sensitive. These are household name Fortune 100 companies, not small nor incompetent. So here's my question: Is that a thing?

Is there a UX reason to intentionally induce errors-of-omission into form submission and force users to correct things when their data was correct in the first place? Is there some science to support this?

Or are trivial UX mistakes just super common on financial sites?

Answer 1

Yes, discarding seemingly trivial information on form fills is common on financial sites. This has to do with concerns about exposing identifiable or nonpublic information.

There are two types of information financial sites are particularly sensitive in handling, PII (Personally Identifiable Information) or NPI (Nonpublic Personal Information). The punishment for exposing PII or NPI can be severe (up to $1 million in fines and/or 5 years in prison under GLBA), so it's easy to see why financial institutions pay special attention to any information, no matter how inconsequential it may seem to us as users.

What's more, PII & NPI can have a very broad interpretation. A very incomplete list of PII & NPI might include:

• Name
• Aliases
• SSN
• Date of Birth
• Place of Birth
• Mother's Maiden Name
• Biometric Records
• Email Address
• Home Address
• Telephone Numbers
• Credit Card Numbers
• ID Numbers (Drivers License/Passport/Etc.)
• Photos
• Religious Affiliation
• Gender
• Height
• Weight
• Marital Status
• Employment Information
• Education History
• IP Address

...etc. You get the idea-- there's A LOT out there that could, potentially, be considered PII or NPI.

That's not to say that, from a UX perspective, financial institutions aren't overzealous in how they protect PII in form fills. Often, this information is discarded on form submission so that there's no concern about liability when passing PII/NPI back and forth between company servers and the user's machine.

This behavior certainly detrimental to usability. However, this is one area where most UX pros will not win a battle against the corporate legal team, regardless of the correctness of their usability arguments.