I had a six character username at Fidelity. Every few weeks I'd get a few password reset emails (or something similar, it was a while ago) and my account would get locked. It was a real pain to deal with but I didn't have a choice, such is the suck of a 401k.
Eventually I went with a much longer username and the problem went away.
I don't know if this is related (probably not), but fun fact: Fidelity lets you log in to your account over the phone using numbers[0] -- one per character. Yep, passwords too.
> Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example:
> To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3
> To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3
My 6 letter username mapped to numbers that corresponded to up to 4^6 accounts. That's really bad but not nearly as bad as what they're doing to passwords.
The longer username is both worse and better. Worse because it matches way way more possible accounts and better because (I presume) it matches fewer actual accounts so it gets fewer failed attempts. That's my guess, anyway.
Edit: it is possible that they only allow one account per "folded" username. That increasing the username length resolved the problem immediately suggests otherwise, but like I said, I dunno. I have no insight into their systems.
0: https://www.fidelity.com/customer-service/faqs-managing-your... look for "telephone services"