My bank requires a number in the password and in the username, but doesn't seem to do any validation that the two inputs contain different numbers before storing them.

I imagine a lot of customers are using the same number in each.