Who takes responsibility when a customer loses money because of bank's poor security?

Postbank.de uses a 6-character pasword (!), and they seem to rely on 2 factor authentication for actually moving money. I assume my transaction history is public.

I'd like to know what incentive besides regulation do banks have in order to keep peoples' accounts private.