In Romania ING limits the password to 5 digits. However SMS 2FA is enabled by default (iirc, have been many years since I have this banking account).