A common security measure that institutions push is to force users to frequently change their password. When discussing this with my bank recently, they simply said “For security purposes, we require you change your password every 90 days.“ For security purposes, that’s not a helpful thing to do.