I'm not trying to say that bank password policies make sense. They do need help.

"Allow weaker passwords and limit login attempts" is not the solution either, because it gives an attacker who has discovered my user id but not my password the ability to lock my account.