LCL does this too. Man those interfaces suck balls

Sucks for users but means you can't use key loggers or click loggers to get users' pins. From a security perspective it's actually pretty good. Even if they offered more complex passwords most people would choose a simple one anyway. This likely reduces fraud for the most vulnerable. It obviously sucks for people who know how to protect their devices.

I've got an account number, which is only used by the bank (though it appears on all bank statements). For some operations (adding a beneficiary for bank transfer, for example), there's a double factor, either on my phone or by postal mail and then there's at least a 24h delay: they must know their security is bad, so the bank limits the damage that can be done, you can't just get hacked and all your account emptied in a hour.

And to change your phone number, you've to use a on-use password, sent by postal mail to your address.

Elsewhere in this thread, a commenter (actually multiple) mentions that many French banks use 6-digit pins for authentication.[0] Another mentions that in Spain, some telcos do the same thing.[1]

[0]: https://news.ycombinator.com/item?id=22360298

[1]: https://news.ycombinator.com/item?id=22356534