Same reason why, at most UK banks, your online credentials (both user and pwd) are case insensitive: it's convenient to the customer. It costs less money to "pay" for the reduced security than it does in attrition causing customer dissatisfaction (which makes them leave), missed transactions, customer support hotline ("I can't login"), etc,