It's quite laughable really, if I'm logging into my bank I type HSBC.co.uk first, anything following that is my International Banking number, following that is my password (which is the best defence you state) and date of birth. If I was required to enter all 8 numbers my password would be the easiest thing to catch.

The only better defence I can think is to have a user enter 3 genuine numbers from their password and 3 randomly generated numbers given to you, but it the 6 numbers are requested randomly. Requesting only random genuine numbers gives you encryption by hiding the sequence of the numbers, if you are also hiding the genuine numbers it's two levels of deceit.