HSBC asks for a primary password as well as 3 random characters of a secondary password. They could hash your original password + each of the characters in your

HSBC asks for a primary password as well as 3 random characters of a secondary password. They could hash your original password + each of the characters in your secondary password, which would mean an attacker would have to crack your primary password first if the database was compromised. From a UI perspective though it's pretty annoying having to enter 3 random characters of a (complex) password, although it's something you get used to.