It could be that the bank was hashing the passwords all along, but just truncating the user's input before hashing it and comparing it to the saved value. Not that I think this is what happened, but I'm just saying it could be.
Unless at some point they started rejecting long passwords just for being long, without checking them against the database. And this is just not plausible.
123456 -> hash code 1
123 -> hash code 2 (which doesn't exist in their db)