This further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all. The only alternative I can thi

This further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all. The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.