This would be a significant vulnerability if bank customers were sophisticated at security, and if those passwords were the only input into their fraud detection systems.