Possibilities 1. They store your plaintext password and then compare to_upper() of your stored password against what you enter on the virtual keyboard (which o

Possibilities 1. They store your plaintext password and then compare to_upper() of your stored password against what you enter on the virtual keyboard (which only supports uppercase letters). 2. They to_upper() your initial password, before they salt/hash, and test the salted hash against the salted hash of whatever you type on the virtual keyboard 3. Either one of the above but with an additional to_upper() on the password you enter at login so that if you do manage to type the password using your keyboard instead of the virtual keyboard it's still case insensitive.