Even this is a wrong move from the bank, I think that using password to have access to sensible service is not the safest way. Would be better if the bank can use some ID-verification service, preferably provided by the government independent company.