My mortgage company has a similar jacked up login process.
Like a lot of places, they have you answer some pretty mind numbing security questions after typing in your user name and password. If you don't remember the security answer you can hit the "I forgot" button. What then happens is shocking - it takes you to a screen to reset the answers. Why in the world do you ask security questions after a user/pass auth if the same info lets you reset them?!!?
And the real kicker. When you want to make a PAYMENT they ask you the last four of your SSN. Who on earth asks for info like that when handing them money???? I could understand withdrawing money....but depositing money?? O_o