An upgrade broke the login, a consumer reported it twice, and applicants heard nothing for three months. Two regulators penalised two different failures.