INAL, but in dealing with some banking software, the situation was explained to me as "Devil take the hindmost." In other words, no bank wants to be the one tha

INAL, but in dealing with some banking software, the situation was explained to me as "Devil take the hindmost." In other words, no bank wants to be the one that implements the worst security, or security that is dramatically worse than "average," whatever that might be. So for example if all the banks offer four digit PINs, there's not much need to offer six, eight, or ten digit PINs. But if a sufficiently large number of banks start offering ten digit PINs, no bank wants to be left behind, because at some point a customer will sue them and claim that they knowingly have lower standards. This is purely anecdotal, but this is how it was explained to me when the product managers for a new product were trying to balance ease of use and accessibility against strength of security.