American Express's passwords are (still! after 10 years!) case-insensitive.

An attack on the US Banking system is a matter of when, not if.