As it's a bank that's probably the case, but you could have a change on the server side from hash($password) == $storedhash to hash(substr($password,0,20

As it's a bank that's probably the case, but you could have a change on the server side from hash($password) == $storedhash to hash(substr($password,0,20)) == $storedhash And you wouldn't get in, with any password (including just putting in the first 20 characters)