Financial institutions are also paying more attention to users’ habits, such as what times of day they tend to access accounts: if usage patterns change drastically, the bank may suspect that the account has been compromised. That extra oversight is useful, since too many users still rely on a primitive memory device that drives security experts nuts: sticking Post-It notes with their passwords on their computer screens.