Incidentally, TIL that Citi Commercial Cards' password policy is ">=1 letter, >=1 number, 6-9 characters". Banks have zero incentive to modernize. They have a

Incidentally, TIL that Citi Commercial Cards' password policy is ">=1 letter, >=1 number, 6-9 characters". Banks have zero incentive to modernize. They have a lot of customers that are never going to move their money, and they don't need to constantly release new products or compete for customers. All they have to do is not piss off their existing customers so much that they move elsewhere. And because that's usually a non-trivial (and potentially costly) process, they don't have much to worry about.