As a long-time Schwab user, one thing I was shocked by is that the login flow silently truncates the password to eight characters. I found this since I tend to have complex suffixes I rotate around, and one day I was able to login with the wrong suffix and even with no suffix at all. This must be due to some legacy process only allowing eight characters.