Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password.
It’s an absolute joke.
It’s an absolute joke.
Unlike any webservice, you usually have very few attempts to make a successful login before getting locked out, so even if it's four digits, the odds of a successful brute force attack are very low
<#>BofA: DO NOT share this code. We will NEVER call you or text you for it.