Btw, I'm not surprised. Back in the early days of FPS, you used to be able to link a random bank account (and use it to top up your WeChat wallet) by just typing the account number...no verification that the account was actually yours!

Probably a conscious decision "this is not secure, but can't think of a easy solution and have to deliver by X, so..chabuduo")