My main bank does this all the time.

To be honest, while I'm aware it's not the best of practices, I don't care much. To me, the most important thing about bank security is that if there are fraudulent operations in my account, I can call and have them undone without much fuss. In this respect, my bank has behaved well in the past when random charges from an exotic country appeared in my credit card, in fact they noticed before I did, gave me a call and everything was fixed immediately.

For this reason, I think I'm OK with banks not having too strict security practices. If at some point they start being really paranoid about security, they might feel tempted to conclude that if there is fraudulent activity, it must surely be the client's fault, because their systems are unbreachable. I'd rather have the current situation in which I don't have much responsibility about security, problems happen but the bank responds.

Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.

Pretty sure all UK banks use this method. For a while a tried to use a complex password for this, it became so annoying to use it is now a simple password that I can remember easily and count out. Like a downgrade attack on my brain.

For the "memorable information", I use a 32 character string that was generated with pwgen. I don't ever remember it asking me for the 25th or 30th character, it's always within the first 20 characters.

My UK bank has a "memorable word" which is separate from the login mechanism (which uses a physical TOTP pad). Authorising online transactions requires you to give "3rd, 6th & 10th letters" eg of your memorable word.

Are you thinking of that?

First Direct do this (but they've been that way for ever) for phone calls (better than me reading out my full password over the phone) along with a couple of secret question answers (I'm pretty sure customer support can't see the whole thing).

Online they are now forcing a one time PIN from a token generated from amount + last four digits of destination account.

This also avoids replay attacks. Unless you use a word in which case it can be deduced.

With my bank, the telephone banking password is very different from the one you use to log in.