I haven't got online statements going back far enough to check right now (will have to do it with paper copies when I get home if I can be bothered). You're probably right though :) I guess they either keep the passphrase in memory (someone enters it once on boot) or another possibility is they have a couple of billing windows each day where they batch through whatever charges/refunds have accumulated since the last run. Feasible I guess with 2 or 3 specially cleared staff members on rotation.