My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.
American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.