February 2026

This morning I got a call from USAA's main support number. Fraud charges at a Walmart in Los Angeles. After 24 years as a member, I recognized the number. But the questions that followed felt wrong — too many, too fast, too interested in my answers when they should have been interested in blocking the charge. I started asking questions back.

They hung up.

Here's the part that's hard to admit: I've spent 25 years in security. I know how these attacks work. And depending on how my day was going — if I'd been distracted, if I'd been between meetings, if my kid had just called — I could have fallen for it. Not because I'm careless. Because the attack was built to exploit trust, not ignorance. Twenty-four years of recognizing that number is exactly what they were counting on.

Modern security assumes identity retention is unavoidable.

We design systems that verify who someone is, store that identity, replicate it across environments, audit it for years, insure it against loss, and then build entire security programs around protecting it indefinitely. This pattern is so normalized that it rarely gets questioned.

If a system ever verifies identity, eligibility, or authorization — this concerns it.

Most modern systems are not built to remember people. They are built to make decisions. And that distinction matters.