The all-time worst I've ever experienced is Korea Exchange Bank.

It only works in MSIE. You have to install a panoply of ActiveX controls. You have to install a "keyboard security" device driver (ha!).

Then, for an actual transaction involving funds transfer, it's a long-winded, 15-20 step process requiring so many layers of authentication that the typical person keeps an unsecured document around detailing what to enter on each step.

I'd kill for plain old HTTPS.

Major Chinese banks are about the same. The best part is that the ActiveX controls are optimized for IE6 (seriously) since various security settings in IE7+ prevent them from working.

Yes, the controls for added security only work with lower security settings. We keep around an dusty old Windows XP machine in the house just for using these websites.

Oh god - don't get me started. I have one that enforces a crazily long password and then asks you for characters taken at specific locations from this password.

Which means that every time I log in I either end up scribbling down my password on a bit of paper or typing it into an editor window.

I refuse to believe this actually improves the level of security.

The reason for this is that they use the same password in the call centre. So when you phone up they say "give us the 3rd letter of your password" and the 2nd digit of your Pin Number. The point of it is to make it hard for a call centre operator to get hold of your password. The internet banks are all built on top of the Direct Bank systems and ported that model in whole or in part to the internet. Legacy systems issue!

You could use Wells Fargo instead - they limit you to 14 characters, which isn't even what I would consider a medium length password.

I'm guessing that he's talking about Barclays in the UK. There the only one's i know who do this.

The Royal Bank of Scotland does this too, though they don't enforce crazy long passwords.

Lloyds TSB in the UK, too.

HSBC do this, but limit you to 10 digits

This.

Another thing that gets to me is trying to check my credit card balance on the Bank of America "Mobile Site". The only number it will show me is the sum of the transactions that have cleared - it's impossible to see my "available credit" (or the information necessary to figure it out) which is probably the only thing I would ever care about on the mobile site.

Of course my completely unscientific tests seem to indicate that the standard, non-mobile site is significantly faster than the mobile one on my N1 in any case... So I'm stuck using that atrocity instead.

Oh, and don't forget Bank of America's Android/iPhone apps, which, last I checked, were just WebViews around their website.

Lucky you don't use my bank: it might just tip you over the edge :). Not only does the back button not work (most of the time), but they've also specifically added back-button detection so they can tell you why:

For security reasons you’re unable to use the Back, Forward and Refresh buttons in your browser.

Uh, ok...

Commonwealth Bank?

Yep. The NetBank project also seems to have involved every second developer in Sydney at some point or another.

Ah, NetBank is not so bad. You can get the basic stuff done without any hassle at all (transfers, BPAY, etc.)

Yeah, I don't find NetBank too bad. It's just the back button issue that's a pain.

NetBank is pretty great in terms of online banking!

AMEN! I never thought a website would be a competitive advantage for a bank, but I am actually switching all my accounts to Wells Fargo because their interface is mediocre (compared to Chase's which is horrendous). I have over a dozen bank accounts, and even more credit cards, between personal and businesses. It's an exponential increase in UI confusion with each account.

As far as banks go, I'm really impressed with NAB (http://nab.com.au).

How often do you log into your carrier or ISP websites? I don't think I have ever visited their websites, much less be bothered by the UI.

How do you pay your bills then?

Monthly direct debit / monthly credit card tx, like any sane person.

If it's a completely flat rate (my ISP), I do that, but if it's a variable rate (like mobile phone), I like to be able to see what they're trying to charge me before I pay it, so I can catch/dispute any weird charges. Especially so in the past year or two, where fraudulent third-party charges on my mobile bill seem to be getting more common.