It is probably worth noting that NatWest will lock your account on 3 unsuccessful login attempts with pin + password + customer-number so brute forcing a passwo

It is probably worth noting that NatWest will lock your account on 3 unsuccessful login attempts with pin + password + customer-number so brute forcing a password would be tricky. They also require a card reader and a physical card to confirm any transactions involving transferring money. - They generate a confirmation code that you enter into the card reader (along with you card pin that is different to your online banking pin). The card reader then generates a confirmation token that authorises the transaction. As the article points out they ask for 3 characters from the password rather than the whole password itself, which when combined with a login attempt limit of 3 helps mitigate the problems of keyloggers on the users' machines. This would be harder to implement with longer passwords and more confusing for users "Please enter character 61 of your password".