activating (or not) HSBC's online banking (retail banking edition)

As part of my account setup, HSBC gave me a physical two-factor device for the retail-banking online banking.  They said it was set up for me.

When I went to register for the online banking, I had to go through the usual process of setting questions about the name of my second gerbil, and so on, this being the state of the art in "security" and "best practice".

It was now apparently ready to log in, but trying to log in brought me to "Secure Key activation" / "Activate your Physical Secure Key".  For this, an activation code was required.  A box popped up saying "Generate activation code" saying "Please tell us how you would prefer to receive your activation code".  I would have preferred to have received it in person at one of the many person-to-person meetings so far.  But the issue with the box that had popped up was: there was no way to select a mechanism, and clicking on "Continue" brought me back to exactly the same "Generate activation code" box.  Thus, we see that HSBC's IT is exactly as good as the IT of other banks.  Banks are about as good at IT as car manufacturers are at in-car electronics.

I asked my contact how to proceed, and later received a call from a colleague in a different jurisdiction.  This rep told me that contact details can not be used for activation within a month of being added, and my contact details were not added.  In order to add my contact details (phone, email), I could do some kind of online signing exercise ("livesign"?).  This is several months into a process of establishing a private banking relationship, with the retail banking side of things, for which this online banking thing is, attached to the private banking.  I said I wasn't happy, because the private banking team had had my contact details for months, there was no doubt about them, so why am I being asked to go through yet more time-consuming and pointless admin to set them again, as though from square one?  We had to end the call.

Later, my account manager called, and they can send the activation by letter, to arrive mid-week the following week.  Okay, but..

All that had to be done here was to establish credentials for using online banking.  Given extensive in-person meetings, it should be very easy to establish such credentials.  A physical device, apparently individualised for me, was handed over.  But because no one at banks understands the fundamentals of information security, what the world ends up with, is increasingly complicated processes in which this depends on that, and you need an activation code, and how shall we send the activation code, well by their registered contact details for activation codes of course, which have to be signed for via live-sign on a web site, and must have been in place for a month before an activation code can be issued over it, and btw if they ever do get logged into the damned thing, let's log them out again after 10 seconds.

None of this complication makes anything more "secure".  The fundamentals are: there are in-person meetings.  These in-person meetings can be used to exchange whatever credentials (activation codes, hardware devices, etc), are needed, in full.  If that is done, and the process is designed properly, then there is no need to revert to "aaaaaarggh! anonymous!!!1" behaviour when the client tries to use these credentials online.

The end result is that months into this, I don't have online banking, but should have, and am awaiting a letter by post, containing an activation code that could have been given to me in person.

^ the button on this does nothing -- it goes in circles.  That's the world we live in.