HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is requested at the same time. This is via a text box with a javascript listener that prevents the email address being pasted in unless the listener is removed. Removing the listener allows the email address to be pasted and the transaction completes successfully.
What advantage is the javascript listener providing to whom? Am I any less secure removing the listener rather than typing the email address by hand?
