You can salt and hash the new password; and the old password can be in plain text. The old password being in plain text doesn't matter so much if it is not pos

You can salt and hash the new password; and the old password can be in plain text. The old password being in plain text doesn't matter so much if it is not possible to access the legacy system directly from outside of the banks network.