> Robinhood: For security purposes, we'll need you to verify the following: Your username, the last 4 digits of your SSN, and your DOB.
> Me: (reluctantly sent them the info, because what else could I do)
> Robinhood: Attached is your requested document. For security purposes, we've encrypted it and set the password to the last 7 digits of your SSN.
(In case you don't know, SSNs are only 9 digits, and the first 3 digits are known based on the location of either where you were born, or where you got the number -- I forget which. I recall the following 2 are also predictable, though I forget exactly how. In other words: they are not hard to guess. And don't forget the whole thing is 9 digits. Meaning it'd take less than a minute [if even a second] for anyone with a copy of my statement to crack it AND extract my SSN from it.)
> Me: (Sends them an email lecture telling them exactly why everything so far has been extremely alarming.)
> Robinhood: Robinhood Financial is a member of the Financial Industry Regulatory Authority (FINRA) and the Securities Investor Protection Corporation (SIPC). We take the security of our members' private information very seriously. Robinhood uses bank-level security measures to protect your personal information. Your password, social security number, and other sensitive data are encrypted. Our mobile and web applications communicate securely using SSL and 256-bit encryption.
(emphasis mine)
Oh, and to top it off, it turned out they had forgotten to actually encrypt the document with my SSN like they had claimed to. In other words they aren't even following their own security policies. Which I'm not sure whether to classify as a good thing or a bad thing given what their policies were.