This is the solution. Implementing auth isn't that difficult.

our govt farms the authorization out to banks (multiple of them), seems to work well. There is also a govt auth on top of that if you don't want that.