“Substitute any special characters with an asterisk.”

I think this answers the question about how passwords at what seems to be a large financial firm are stored - after all, there's only one way to know which of the characters in the stored password are special...