It all started with hope, excitement, and goosebumps...

The Citibank pre-sale for Rush tickets. I was ready. Logged in early. Queue position 134. Perfect. The gods of prog rock were smiling. I had my eye on the front row, meet-and-greet package. A once-in-a-lifetime chance to get a photo with Geddy Lee and Alex Lifeson. Pricey, yes, but you can't put a dollar value on lifelong fandom. Clicked checkout. Declined.

What?!

Plenty of credit, no fraud, no reason. Just a cold, heartless decline. Tried again. Declined again. I logged on to my Citibank account. No warnings. No notices. Nothing. I even made an extra payment on that card just in case that was it. No help. And then, like an ambulance showing up long after the patient has flatlined, Citibank texts me five minutes later: "Was this you?" Yes, it was me, damn it! I replied faster than Neil Peart's 16th-note fill. "Great," they said, "try your purchase again." But by then, Ticketmaster (or as the ancient tongues call it, TicketBastard) had already released my seats. Gone. Evaporated into the scalperverse. And now there's 51,972 people in the queue in front of me. FML!

I filed complaints with both Citibank and Ticketmaster, because this wasn't just a minor inconvenience. This was corporate incompetence wrapped in the self-righteous banner of "fraud prevention." It's like getting mugged by a security guard who apologizes and says it's for your own safety. Citibank delayed, Ticketmaster punished me for it, and both ended up helping the very bots they claim to fight. I told Citi: "Your system's delay directly caused me to lose a once-in-a-lifetime experience." I told Ticketmaster: "Your release window is too short. Give people a grace period to fix a payment issue." Will either listen? Probably not. But Ticketmaster will still get paid because some scalper bot farm halfway around the world has grabbed the tickets.

This isn't the first time I've complained about overzealous security. I've written about it before (see footnotes). The irony is that the more you try to "protect" customers, the more you end up punishing them. There's a fine line between security and stupidity, and we've long since crossed it. These companies act like every login attempt is a potential act of cyberterrorism. It's a concert ticket, not a nuclear launch code. Nobody's stealing state secrets to hear Tom Sawyer.

Citibank should have responded much quicker with that "is this you?" text. It was over 5 minutes before I received it. I know for a fact that American Express gets those texts to me within seconds in similar situations. When I went to the UK a few months ago, it happened a few times. Ticketmaster should have given me at least 5 to 10 minutes to complete my order. I realize they can't hold the tickets indefinitely, but 90 seconds? Come on. You'd think a company that charges $200 in service fees could afford a 5-minute timeout buffer.

And it's not just banks and ticket sites. You can't even log in to social media without a "just to make sure" verification text. Want to check your account? Better have your phone, your backup code, your mother's maiden name, and your childhood pet's blood type ready. Every login now feels like I'm trying to defuse a bomb. Cut the red wire, confirm your identity, prove you're human, identify all the motorcycles, spin three times... At this point, if someone did hack me, I'd probably hand them the password just to see if they could get through faster.

Now, here's where it gets relevant for my students and fellow developers: this is exactly what NOT to do when designing software. Don't make your systems so secure that they're unusable. If you build an Access database, ask yourself what's actually at risk. If someone breaks into a customer's account on my site, the worst they can do is watch video lessons and maybe request your next Learning Connection lesson. I don't store credit cards or sensitive data online. I can reverse a charge if need be. So no, you don't need two-factor authentication for every click. Right-size your security to the risk.

This lesson goes beyond security and coding.

In business, overprotection kills opportunity. Companies that require ten meetings, three signatures, and a blood oath before approving a new idea usually get left behind by competitors who just try things. Risk management is good - risk paralysis is fatal. Somewhere out there, a committee is still meeting about whether to schedule the next meeting. The same goes for customer experience. If your website has 14 login steps and a CAPTCHA that looks like a Rorschach test, people will just go to your competitor. Security that drives customers away isn't security - it's sabotage. I've had clients before where I spent hours with a manager going over specs for their new database system or network. After putting in all that time, he needed to "run it up the chain" and deal with superiors who didn't know squat, were worried about upsetting the status quo, and had to themselves get everything signed-off on in triplicate. I got to the point where I started refusing to meet with anyone but the decision-maker.

Overprotection in relationships looks like jealousy disguised as care. The partner who checks your phone, wants constant updates, or insists on knowing where you are every minute tells themselves it's love, but it's really control. Healthy relationships require vulnerability and a little risk. If you lock someone down so tightly they can't breathe, they'll eventually find a way to escape. Usually through the back door, right after you've installed the GPS tracker. Trust is like a muscle - it only strengthens when you give it some freedom to move.

Speaking of muscles, overprotection shows up as fear of injury or obsession with perfection. The guy who never lifts heavy because he's afraid of pulling something never gets stronger. The woman who doesn't lift heavy because she doesn't want to get "too bulky" is doing herself a disservice. Trust me, you need to lift a lot and eat a ton of protein to "get jacked." The person who eats so "clean" they never enjoy food eventually burns out. You can't bubble-wrap your body and expect it to grow. Muscles, like minds, adapt to stress. Progress requires calculated risk - enough strain to challenge you, not so much that you break. Though at my age, sometimes just tying my shoes qualifies as progressive overload.

In politics, overprotection turns into overreach. Leaders claim they're "keeping citizens safe," but too often it means watching, censoring, or restricting them. We trade privacy for the illusion of security. It's the political version of Citibank's fraud alert - protecting you from something that might happen by making sure you can't do anything at all. Real freedom includes a little risk. A society afraid of everything eventually stops moving forward. Part of the risk of having a democratic society is that you have to balance security with freedom.

In religion, overprotection becomes dogma. When people are told not to question, not to think, and not to read anything outside their sacred book, that's not faith - that's fear disguised as faith. It's like installing so many spiritual firewalls that no new ideas can get through. If your beliefs can't survive honest inquiry, they're not strong - they're brittle. Real enlightenment requires curiosity, not quarantine.

So yeah, Citibank and Ticketmaster, thanks for the life lesson. You taught me that trying too hard to prevent loss is the fastest way to cause it. In your noble quest to save me from imaginary hackers, you managed to block the one person actually authorized to spend the money. Well done. You didn't stop fraud - you stopped fandom. You protected my account so effectively that even I couldn't use it.

You built Fort Knox around a credit card purchase, then handed the keys to a chatbot. Citibank's algorithm decided to guard me from myself, and Ticketmaster's system decided that 90 seconds of inactivity meant I had vanished into the ether. Bravo! Your digital gatekeepers worked perfectly. Take a bow, Skynet. You've officially protected me from joy. The bad guys were stopped, and so was I. At this point, your security is like a knight guarding the castle long after it's already burning down - loyal, vigilant, and completely missing the point.

But hey, you did give me something priceless: a perfect case study in how not to design a system. Every day I tell my students to build software that serves people, not policies. To think through the human side of design. You reminded me what happens when you forget that. A good system protects users without treating them like suspects. Yours failed that test spectacularly.

Captain Kirk once destroyed a computer named Landru because it "protected" its people by taking away their freedom. Maybe Citibank and Ticketmaster could learn something from that. Safety without freedom isn't protection - it's paralysis.

So thanks, Citibank and Ticketmaster. You may have cost me front-row Rush tickets, but you gave me something else: a masterclass in corporate face-planting, or as I like to call it a front-row seat to your own incompetence. And for that, I'll take a slow clap from the back row - where apparently I belong in the great hierarchy of "customers we care about, but not too much."

LLAP
RR

Other Articles:
- 2FA is Dumb!
- Dead Phone, Again!
- Modern Authentication is a Mess

P.S. I did finally manage to score seats to a different show. So I'm happy about that at least. It's not the front-row meet-and-greet that I was aiming for, but I suppose the meek shall inherit the 2nd row.