I understand the logic of disabling PASTE in secondary account number - to make the user really be sure of the number by hand entering it twice.
A - that's annoying
B - the way you do it is ineffective because I can SEE the 1st field and just eyeball copy it even if it's wrong.

Suggestions:
1 - Allow paste in to 2nd field - everyone hates that it's disabled
-- OR --
2 - If you insist on hand typing the second field, turn the 1st field to STARS (password field type) when you leave it (onblur) so the user is forced to read it from the original source.