Bank had no firewall license, intrusion or phishing protection – guess the rest