Ah. You may want to double check that:

http://www.bmo.com/home/about/banking/privacy-security/prote...

Maybe your the victim of a Phishing attack or something, for example maybe a fake site told you you had to use 4 digits.

Honestly I've heard of a lot worse then this:

http://www.bmo.com/home/about/banking/privacy-security/how-w...