fwiw, it probably depends on the bank and the customer. I used to work for a large insurance company in London. There I could (and did) authorise 6 digit transfers to new accounts with just a fax with the (perpetually busy) directors signature. One time the bank made a mistake, and one simple phonecall from me was all it took to resolve (with no verification of who I was - unless they did some callerid check?). The level of customer service was astonishing to me, but that account was probably worth it to the bank to eat any fraud until it got too serious.

Signature has to match and they do call you to confirm, but your are right that there is no cryptograpgic security, its all judgement call by meat