Quoting: As the user doesn't supply the whole password it cannot be verified against a stored digest of the whole password. It points out that thi

Quoting: As the user doesn't supply the whole password it cannot be verified against a stored digest of the whole password. It points out that this (partially) protects one from eavesdropping, but it doesn't say how the password can be verified unless the service stores the password in clear, which it admits is inadvisable. So that doesn't explain how it works, unless you accept that the bank is storing the password in plaintext. Question still open.