This seems to me a very appropriate distribution of responsibilities. When the internet dating site gets hacked, as they inevitably do, all the criminals will obtain is a meaningless token: they have no idea who it belongs to, and Barclays won’t tell them.
