I have to call up to get my password reset because it's been locked - a mere week after our last quarterly password change. It's not that I forgot it; 10 minutes previously it was working fine. I don't know what triggered the lock, but that's not the WTF.
Get to the point where I'm asked security questions. But not the ones I entered in the website, no, the first one is "what's your office number?"
"No idea. Hey, [office mate], can you poke your head around and tell me our office number?"
Second question. "What's your phone extension?"
"Erm, not a clue." I look at the phone. Aha - it shows up on the display.
I even asked the IT guy if he realized that he just asked me two security questions that anybody sitting where I was could answer. He's not concerned. He's sure I'm who I say I am.
Yeah, and just last month we had a massive security initiative in response to a recently-revealed (but very old) code leak. Good to know everyone's taking it seriously.