This is par for the course for financial institutions. A credit union I previously had an account with required your passwords to be exactly six characters lon

This is par for the course for financial institutions. A credit union I previously had an account with required your passwords to be exactly six characters long. Then they added "two factor authentication" via SMS or phone call. Except now if you forgot your password then you just have to go to "forgot password" and get an SMS code sent to your phone to reset your password... So it was actually single factor authentication, you didn't need the password at all, just the phone.