T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN.

Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security

Swiss bank Cler is guilty of this too, in a way.

At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.

HSBC UK does this.