The form nobody questioned

A woman in Abu Dhabi tries to buy a bookshelf from a small furniture website late one evening.

Before she can pay, she has to create an account. The password must be between eight and twelve characters, include a capital letter, a number and a symbol, but not certain symbols, and it cannot contain any part of her name. The phone field rejects her number because she typed a space. The country list begins with a place she has never visited and puts her own somewhere near the bottom.

She closes the tab. The bookshelf stays in the warehouse.

None of these rules were written by someone who wanted to lose a sale. They were copied from a template years ago, or added after somebody felt nervous, or kept because changing them seemed like more work than leaving them. The password rules in particular make nothing safer. People faced with them write the result on a sticky note or reuse the one they use everywhere, which is the opposite of the intent.

It is not stupidity. It is fear and superstition, the comfortable feeling that strict must mean careful. And because the person approving the page never tries to buy anything through it, it looks fine from where they sit.

We would not accept this anywhere else. If a builder put a step at the shop entrance that tripped every third customer, someone would fix it by the afternoon.

The form matters less than what it reveals. If something this visible can survive because nobody looked closely, it is worth asking what else in the business is running on habit rather than thought, and who would have to try using it to notice.