A company that my retirement plan used to be with was worse than that. The password could only be numbers and letters, and they would silently truncate your password to 8 characters. The worst part though, is the password was stored in a way that it could be entered on a touch tone phone. So case was silently ignored for letters, and the characters "2abcABC" were all stored as the number 2, and so on for the rest of the buttons on the phone. They also didn't support two-factor authentication. They've since updated the password requirement to something more sane, but it was baffling that they would ever do that.

All major telecos in Spain do the same. One of the largest asks you to set up only a 6-digit PIN to access the customer portal and no 2FA. They send you your PIN by SMS as a confirmation. All your invoices (with the details of the numbers you called) as well as other personal details, are "protected" by a 6-digit PIN. I want to think they have other protection mechanisms in place, but I seriously doubt it.

Oh, I see you've had a Fidelity account too.

Expect this to keep happening until we put the full and entire cost of identify theft onto the companies who are defrauded by the thief.

It's not identity theft, it's just fraud. Calling it identity theft is an attempt to put the cost and responsibility for ordinary fraud on the victims.

"We know what we're doing" and "There's no way we can upgrade the infrastructure" might be holding hands in that moment

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say:

"At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers.

From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password.

...

Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..."

Passwords remained fixed at 6 characters however.

The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '<input type="password">' element, and add 'value="[paste]"' manually.

I used to bank with WestPac and from memory it wasn’t possible to do this as they had some additional javascript running that would cipher every letter.

I got firefox to remember passwords for a couple sites that were blocking autofill. It involved opening up the xml file where passwords are stored, copying the latest entry, changing the url and ID number, then opening up the password manager in firefox and updating the actual password there since the XML file only stores an encrypted version. It wouldn't autofill instantly, had to click on the username box to get it to work but it saved me a lot of time from entering a massive password that system required.

This is common in Brazil as well. Allegedly they are trying to avoid keyloggers. Obviously people just improved keyloggers to take screenshots at precise times.

Looks like they are using Fiserv (lots of Fiserv references in the code). Fiserv is a huge provider of banking services. If Fiserv is requiring these ridiculous id/pw requirements that would be even more scary.

Mainframe it is then.

could be (old) cobol, not necessarily on a mainframe

ING Australia is even worse for this, as it’s an 8 digit acc number with a 4 digit PIN to login.

St. George isn’t as terrible, but they have a quirk of requiring a 4 digit security number along with your password. That’s not how MFA works...

Better security practices and open APIs are the two things I wish banks would get sorted.

TIL my Westpac password is case insensitive. Today wasn't a good day.